Regular Expression Denial of Service in micromatch Package
Summary
CVE-2024-4067: The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). Affects node-micromatch across 2 version ranges.
< 03aa8052171e878897eee5d7bb2ae0ae83ec2ade
< 8bd704ec0d9894693d35da425d827819916be920
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The micromatch package is a popular NPM module used for matching file paths and strings using glob patterns. It is widely utilized in various JavaScript applications for its efficiency and flexibility in pattern matching. However, prior to version 4.0.8, micromatch was vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which could lead to performance degradation or application hang-ups when processing malicious input.
Vulnerability Detail
The vulnerability arises from the greedy nature of the regular expression pattern .* used in the micromatch.braces() function. When a malicious payload is passed, the regex engine may enter a state of excessive backtracking, consuming significant CPU resources and causing the application to slow down or become unresponsive. This issue is particularly concerning as it can be exploited by attackers to disrupt service availability, especially in applications that rely heavily on micromatch for input validation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the types of patterns that can be processed by micromatch. Avoid using patterns that could lead to excessive backtracking, such as those containing greedy quantifiers like .*.
Conclusion
The micromatch package has a critical vulnerability that can lead to Regular Expression Denial of Service attacks. It is essential to upgrade to version 4.0.8 or later to mitigate this risk. Implementing input validation can serve as a temporary workaround while ensuring the application's performance and reliability.
See every vulnerability recorded for node-micromatch →
FAQ
ReDoS is a type of attack that exploits the backtracking behavior of regular expressions, causing the application to consume excessive CPU resources and potentially leading to service unavailability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of micromatch prior to 4.0.8 are affected by this vulnerability.
Implement input validation to restrict the patterns processed by micromatch and avoid using greedy quantifiers in your regex patterns.
While this vulnerability primarily affects application performance, it does not directly lead to data loss. However, prolonged denial of service could impact user experience and application reliability.
Related vulnerabilities
Recent vulnerabilities recorded for node-micromatch.
