ReDoS Vulnerability in normalize-url Package Affects node-got
Summary
CVE-2021-33502: The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs. Affects node-got across 2 version ranges.
< 11.8.1+~cs53.13.17-3
< 305e3f22efb87505d3bc87c17c50b1ef67789acb
Fixed in 11.8.1+~cs53.13.17-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The normalize-url package is a widely used Node.js library that normalizes URLs by removing unnecessary characters and ensuring a consistent format. It is often utilized in various applications to handle URL inputs effectively. However, certain versions of this package are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can lead to performance degradation when processing specific types of URLs, particularly data: URLs.
Vulnerability Detail
The vulnerability, identified as CVE-2021-33502, arises from the use of regular expressions in the normalize-url package, which can exhibit exponential performance issues when handling certain inputs. This can allow an attacker to exploit the vulnerability by sending specially crafted data: URLs, causing the application to hang or crash due to excessive resource consumption. The affected versions include normalize-url versions before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1. The potential ramifications include service downtime and degraded performance, which can significantly impact user experience and application reliability.
How To Fix
Minimum fixed version
11.8.1+~cs53.13.17-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-gotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to filter out potentially malicious data: URLs before they are processed by the normalize-url package. This can help mitigate the risk of exploitation until a proper update can be applied.
Conclusion
The CVE-2021-33502 vulnerability in the normalize-url package poses a significant risk to applications using affected versions. It is crucial to update to the latest version to mitigate potential attacks. Additionally, implementing input validation can serve as a temporary workaround until updates are applied.
See every vulnerability recorded for node-got →
FAQ
CVE-2021-33502 is a vulnerability in the normalize-url package that allows for a ReDoS attack due to inefficient regular expressions.
Versions before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 are affected by this vulnerability.
Exploitation of this vulnerability can lead to application crashes and significant performance degradation, impacting user experience.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2021-33502 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-got.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
