Regular Expression Denial-of-Service in trim-newlines Package
Summary
CVE-2021-33623: The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method. Affects node-trim-newlines across 2 version ranges.
< 3.0.0-1+deb11u1
< b63718391b436e87fe9b29052c1b9274786e89fa
Fixed in 3.0.0-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The trim-newlines package is a Node.js utility designed to remove newline characters from the beginning and end of strings. It is widely used in applications that require string manipulation, ensuring clean data input and output. However, versions prior to 3.0.1 and 4.x before 4.0.1 are susceptible to a vulnerability that can be exploited through regular expressions, leading to potential denial-of-service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-33623, arises from a flaw in the .end() method of the trim-newlines package. This flaw allows attackers to craft specific inputs that cause excessive backtracking in the regular expression engine, leading to performance degradation and potential application crashes. The impact of this vulnerability can be severe, especially in applications that process untrusted input, as it can render the application unresponsive or slow.
How To Fix
Minimum fixed version
3.0.0-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-trim-newlinesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the types of strings that can be processed by the trim-newlines package. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
The trim-newlines package has a significant vulnerability that can lead to denial-of-service attacks if not addressed. It is crucial for developers using this package to update to the latest version and consider implementing input validation as a temporary measure. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for node-trim-newlines →
FAQ
CVE-2021-33623 is a vulnerability in the trim-newlines package that allows for regular expression denial-of-service attacks through the .end() method.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to application crashes or significant slowdowns, especially when processing untrusted input.
Versions of trim-newlines prior to 3.0.1 and 4.x before 4.0.1 are affected by this vulnerability.
Yes, implementing input validation to restrict the types of strings processed by the trim-newlines package can help mitigate the risk until an update can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for node-trim-newlines.
