CVE-2022-2596: node-fetch Inefficient Regular Expression Complexity

Background

node-fetch is a lightweight module that brings window.fetch to node.js. It allows developers to make HTTP requests in a simple and efficient manner. However, versions of node-fetch prior to 3.2.10 are vulnerable to a Regular Expression Denial of Service (ReDoS) issue. This vulnerability exists in the isOriginPotentiallyTrustworthy() function in referrer.js. When processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a', the regular expression used in the function exhibits inefficient complexity, making it susceptible to ReDoS attacks.

Vulnerability Detail

The vulnerability in node-fetch arises due to inefficient regular expression complexity. An attacker can exploit this vulnerability by sending a specially crafted URL string that triggers the inefficient regular expression, causing the application to enter into a high-complexity loop. This can lead to a Denial of Service (DoS) condition, where the application becomes unresponsive or crashes. The impact of this vulnerability can vary depending on the application's usage of node-fetch and the attacker's ability to send malicious requests.

npm install node-fetch@3.3.2

npm install node-fetch@3.2.10

Workaround

If upgrading to the latest version is not feasible, a possible workaround is to validate and sanitize user input before passing it to node-fetch. By ensuring that the URL strings are properly formatted and do not contain any malicious patterns, the risk of triggering the inefficient regular expression can be mitigated. Here is an example of how to sanitize a URL string in JavaScript:

const sanitizeUrl = (url) => {
  const sanitizedUrl = url.replace(/[^a-zA-Z0-9-._~:/?#[\]@!$&'()*+,;=]/g, '');
  return sanitizedUrl;
};

Conclusion

In conclusion, node-fetch versions prior to 3.2.10 are vulnerable to a Regular Expression Denial of Service (ReDoS) issue. This vulnerability can be exploited by sending a specially crafted URL string, leading to a Denial of Service (DoS) condition. It is recommended to upgrade to node-fetch version 3.2.10 or later to mitigate this vulnerability. If upgrading is not feasible, developers should validate and sanitize user input before passing it to node-fetch. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for node-fetch →

FAQ