Denial of Service Vulnerability in Node-Fresh Package
Summary
DEBIAN-CVE-2017-16119: Fresh is a module used by the Express.js framework for HTTP response freshness testing. Affects node-fresh versions < 0.2.0-2. Fixed in 0.2.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Fresh is a module utilized by the Express.js framework, designed to facilitate HTTP response freshness testing. It helps ensure that responses are not stale and are still valid for client requests. However, this package is vulnerable to a specific issue that can lead to denial of service, impacting applications that rely on it for efficient HTTP response handling.
Vulnerability Detail
The vulnerability in Node-Fresh arises from its handling of specially crafted input, which triggers a regular expression denial of service (ReDoS). When such input is processed, it can block the event loop, resulting in a denial of service condition. This can severely affect the performance and availability of applications that depend on the Express.js framework for handling HTTP requests.
How To Fix
Minimum fixed version
0.2.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-freshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize and restrict the types of input that are passed to the Node-Fresh module, thereby mitigating the risk of triggering the denial of service condition.
Conclusion
The Node-Fresh package contains a vulnerability that can lead to denial of service due to improper handling of input. It is crucial to update to the patched version to ensure the security and performance of applications using this module. Implementing input validation can serve as a temporary measure until an update can be applied.
See every vulnerability recorded for node-fresh →
FAQ
The vulnerability is a regular expression denial of service (ReDoS) that can block the event loop when specially crafted input is processed.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The primary consequence is a denial of service, which can lead to application downtime and degraded performance for users relying on the affected services.
Yes, a patched version of Node-Fresh (0.2.0-2) is available. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, implement input validation to restrict the types of input processed by Node-Fresh as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-fresh.
