CVE-2021-39176: detect-character-encoding - Missing Release of Memory after Effective Lifetime
Summary
CVE-2021-39176: Missing Release of Memory after Effective Lifetime in detect-character-encoding. Affects detect-character-encoding versions < 0.3.1. Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The detect-character-encoding package is an npm library used for detecting the character encoding of a given text or buffer. It provides functionality to analyze the byte order mark (BOM) and other indicators to determine the encoding. This vulnerability affects versions 0.3.0 and earlier of the detect-character-encoding package.
Vulnerability Detail
The vulnerability in detect-character-encoding v0.3.0 and earlier arises from the failure to release allocated memory. This can lead to memory leaks and potential denial-of-service (DoS) scenarios. An attacker could exploit this vulnerability by repeatedly triggering the allocation of memory, causing the Node.js process to consume more and more memory over time. The severity of the vulnerability is rated as High with a CVSS score of 7.5.
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
npm install detect-character-encoding@0.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround can be implemented by manually releasing the allocated memory after its effective lifetime. The following code snippet demonstrates a workaround for the vulnerability:
const express = require("express");
const detectCharacterEncoding = require("detect-character-encoding");
const app = express();
app.get("/", (req, res) => {
const result = detectCharacterEncoding(Buffer.from("foo"));
// Manually release memory
result.detected = null;
res.end();
});
app.listen(3000);
By setting the detected property of the result to null, the allocated memory is released manually.
Conclusion
The detect-character-encoding package in versions 0.3.0 and earlier suffers from a vulnerability that allows memory leaks and potential denial-of-service (DoS) attacks. It is crucial to update to version 0.3.1 or later to address this issue. A temporary workaround is available by manually releasing the allocated memory. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for detect-character-encoding →
FAQ
detect-character-encoding is an npm library used for detecting the character encoding of a given text or buffer. It analyzes indicators like the byte order mark (BOM) to determine the encoding.
Versions 0.3.0 and earlier of detect-character-encoding are affected by this vulnerability.
The vulnerability can lead to memory leaks and potential denial-of-service (DoS) scenarios. An attacker could exploit this vulnerability to consume excessive memory, causing the affected process to become unavailable.
To fix this vulnerability, update the detect-character-encoding package to version 0.3.1 or later. This patched version ensures that memory is properly released after its effective lifetime.
Yes, a temporary workaround is available. Manually releasing the allocated memory after its effective lifetime can mitigate the vulnerability. Refer to the provided code snippet for an example.
References
Related vulnerabilities
Recent vulnerabilities recorded for detect-character-encoding.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
