CVE-2021-33502: ReDoS in normalize-url
Summary
CVE-2021-33502: ReDoS in normalize-url. Affects normalize-url across 3 version ranges.
>= 4.3.0, < 4.5.1
>= 5.0.0, < 5.3.1
>= 6.0.0, < 6.0.1
Fixed in 4.5.1, 5.3.1 or 6.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- node-got · Debian:11
The same CVE-2021-33502 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The normalize-url package is a popular Node.js package used for normalizing URLs. It provides a set of functions to ensure consistent and standardized URL formatting. However, versions before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 of normalize-url are vulnerable to a ReDoS (Regular Expression Denial of Service) issue. This vulnerability can be exploited by an attacker to cause a denial of service attack by providing specially crafted data: URLs. The exponential performance of the affected function, normalize-url, makes it susceptible to this type of attack.
Vulnerability Detail
The ReDoS vulnerability in normalize-url arises due to the exponential performance of the affected function when processing data: URLs. An attacker can exploit this vulnerability by providing a maliciously crafted data: URL, causing the function to enter into an infinite loop and consume excessive CPU resources. This can lead to a denial of service condition, rendering the affected application unresponsive or causing a significant degradation in performance. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 4.5.14.5.1npm install normalize-url@4.5.1 -
>= 5.0.0, < 5.3.15.3.1npm install normalize-url@5.3.1 -
>= 6.0.0, < 6.0.16.0.1npm install normalize-url@6.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of normalize-url as mentioned in the 'how_to_fix' section.
Conclusion
The ReDoS vulnerability in normalize-url can be mitigated by upgrading to the latest fixed versions. It is crucial to promptly update the package to ensure the proper handling of data: URLs and prevent potential denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for normalize-url →
FAQ
normalize-url is a Node.js package used for normalizing URLs. It provides functions to ensure consistent and standardized URL formatting.
A ReDoS (Regular Expression Denial of Service) vulnerability occurs when a regular expression pattern can be exploited to cause a denial of service attack by providing specially crafted input that triggers excessive backtracking in the pattern matching algorithm.
This vulnerability can lead to a denial of service condition, causing the affected application to become unresponsive or experience significant performance degradation.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to the latest fixed versions of normalize-url (4.5.1, 5.3.1, or 6.0.1).
