Denial of Service Vulnerability in Node-Fresh Package
Summary
CVE-2017-16119: Fresh is a module used by the Express.js framework for HTTP response freshness testing. Affects node-fresh versions < 0.2.0-2. Fixed in 0.2.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Fresh is a module utilized by the Express.js framework for testing the freshness of HTTP responses. It plays a crucial role in ensuring that responses are served efficiently and accurately based on their freshness criteria. However, this package has been identified as vulnerable to a regular expression denial of service (ReDoS) attack, which can severely impact the performance of applications relying on it.
Vulnerability Detail
The vulnerability, identified as CVE-2017-16119, arises when the Node-Fresh module is fed specially crafted input that triggers excessive backtracking in its regular expression parsing. This can lead to the event loop being blocked, resulting in a denial of service condition where legitimate requests cannot be processed. The severity of this vulnerability is rated at a CVSS score of 7.5, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
0.2.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-freshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize and limit the types of inputs that can be processed by the Node-Fresh module. This can help prevent the triggering of the vulnerable regular expression. Additionally, monitoring application performance for unusual spikes in latency can serve as a temporary measure.
Conclusion
The CVE-2017-16119 vulnerability in the Node-Fresh package poses a significant risk of denial of service attacks. It is crucial for developers to update their dependencies promptly and consider implementing workarounds to protect their applications until an update can be applied. Regular monitoring and validation of inputs can further enhance security.
See every vulnerability recorded for node-fresh →
FAQ
CVE-2017-16119 is a vulnerability in the Node-Fresh package that allows for a denial of service attack through specially crafted input.
If your application uses the Node-Fresh module, it may become unresponsive or slow when exposed to malicious input, impacting user experience.
Implement input validation and monitor your application for performance issues as a temporary workaround until you can perform the update.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-16119 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-fresh.
