Regular Expression Denial of Service (ReDoS) in Node.js
Summary
CVE-2018-7158: The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. Affects nodejs across 3 version ranges.
>= 6dc12b1042d5d4727f77e8a1c5758dab91400069, <= b8eef6d10bf45a4d659a84d670dbf3afff0250a2
< 8.11.0-r0
>= f9f837885343a2a3f5ba2b8c510eaac395c8c865, <= 85df6ada477715020dbd22e2fb5e687d84d663ff
Fixed in 8.11.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime environment that allows developers to build scalable and high-performance applications. It provides various modules and APIs for different functionalities, including the 'path' module for working with file paths. However, versions of Node.js 4.x are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The 'path' module in Node.js 4.x contains a potential ReDoS vector due to the structure of the regular expression used for path parsing functions. This vulnerability allows an attacker to craft a malicious string that, when processed by functions like 'path.dirname()', 'path.extname()', or 'path.parse()', can cause a significant delay in evaluation, potentially leading to a denial of service. The issue was addressed in Node.js 6.x and later versions.
How To Fix
Minimum fixed version
8.11.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround is to sanitize user input before passing it to the affected path parsing functions. This can involve validating and limiting the input to prevent the exploitation of the ReDoS vector.
Conclusion
The Regular Expression Denial of Service vulnerability in Node.js 4.x can be mitigated by upgrading to a fixed version (8.11.0 or later) or by sanitizing user input. It is crucial to promptly address this vulnerability to prevent potential denial of service attacks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a JavaScript runtime environment that allows developers to run JavaScript code outside of a web browser. It provides a platform for building server-side and networking applications.
A ReDoS attack is a type of denial of service attack that exploits the way certain regular expressions are processed. By crafting a malicious input that triggers a slow evaluation of the regular expression, an attacker can cause a significant delay or even a complete freeze of the targeted system.
This vulnerability impacts all versions of Node.js 4.x. Node.js 6.x and later versions have addressed the issue by replacing the vulnerable code.
Exploiting this vulnerability can lead to a denial of service, where the affected Node.js application becomes unresponsive or experiences significant delays in processing requests. This can disrupt the normal functioning of the application and impact its availability.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your Node.js application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
