Critical Vulnerability in node-es5-ext: Function Name Length Causes Script Stall
Summary
DEBIAN-CVE-2024-27088: es5-ext contains ECMAScript 5 extensions. Affects node-es5-ext versions < 0.10.64+dfsg1+~1.1.0-1. Fixed in 0.10.64+dfsg1+~1.1.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-es5-ext is a package that provides ECMAScript 5 extensions, enhancing JavaScript functionality with additional methods and properties. It is widely used in various applications to improve code efficiency and readability. However, this package has been identified to have a vulnerability that can lead to performance issues when handling functions with excessively long names or complex default argument names.
Vulnerability Detail
The vulnerability arises from the way the node-es5-ext package processes function names in its methods, specifically function#copy and function#toStringTokens. When functions with very long names or intricate default argument names are passed to these methods, it can cause the script to stall, leading to potential denial of service. This issue is particularly concerning as it can affect the performance of applications relying on this package, making them unresponsive under certain conditions.
How To Fix
Minimum fixed version
0.10.64+dfsg1+~1.1.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-es5-extTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using functions with excessively long names or complex default argument names when utilizing the function#copy or function#toStringTokens methods in the node-es5-ext package.
Conclusion
The node-es5-ext package has a critical vulnerability that can cause scripts to stall under certain conditions. It is crucial for users to update to the patched version to ensure application stability and performance. Temporary workarounds can mitigate the issue until an update can be applied.
See every vulnerability recorded for node-es5-ext →
FAQ
The vulnerability allows scripts to stall when functions with long names or complex default arguments are processed, potentially leading to a denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using the vulnerable methods with problematic function names as a temporary workaround.
Yes, the vulnerability is patched in version 0.10.64+dfsg1+~1.1.0-1 of the node-es5-ext package.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-27088.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-es5-ext.
