Denial of Service Vulnerability in ssri
Summary
CVE-2021-27290: ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Affects nodejs across 2 version ranges.
>= 0fb45e7e0eba615bf0080bf350c95e19412ff9a9, < b7c8c7c61db89aeb9fbf7596c0ef17071bc216ef
< 14.16.1-r1
Fixed in 14.16.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ssri is a package used for processing Subresource Integrity (SRI) hashes in Node.js applications. SRI is a security feature that ensures the integrity of resources loaded from external sources. However, ssri versions 5.2.2-8.0.0 are vulnerable to a denial of service attack. This vulnerability affects consumers using the strict option and can lead to a significant impact on application availability.
Vulnerability Detail
The vulnerability (CVE-2021-27290) in ssri arises from a regular expression used to process SRIs. Malicious SRIs can cause the regular expression to take an extremely long time to process, resulting in a denial of service. This can be exploited by an attacker to exhaust system resources and render the application unresponsive. It is important to note that this vulnerability only affects consumers using the strict option.
How To Fix
Minimum fixed version
14.16.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a temporary workaround is to disable the strict option in ssri. This can be done by modifying the application code or configuration to avoid using the strict option when processing SRIs. However, it is strongly advised to apply the official fix as soon as possible.
Conclusion
The denial of service vulnerability in ssri can have a significant impact on application availability. It is recommended to upgrade to version 8.0.1 or later to fix the issue. If immediate upgrade is not possible, disabling the strict option can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
ssri is a package used in Node.js applications to process Subresource Integrity (SRI) hashes. It ensures the integrity of resources loaded from external sources.
The vulnerability can lead to a denial of service attack, causing the application to become unresponsive and impacting availability.
This vulnerability affects consumers using the strict option in ssri versions 5.2.2-8.0.0.
Upgrade to ssri version 8.0.1 or later. Alternatively, disable the strict option as a temporary workaround.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to apply the fix or workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
