Regular Expression Denial of Service Vulnerability in Node Micromatch Package
Summary
DEBIAN-CVE-2024-4067: The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). Affects node-micromatch versions < 4.0.7+~4.0.7-1. Fixed in 4.0.7+~4.0.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Node Micromatch package is a widely used utility for matching file paths and strings against patterns. It is particularly valued for its performance and flexibility in handling complex matching scenarios. However, it has been identified to have a vulnerability that can lead to a Regular Expression Denial of Service (ReDoS), which can severely impact applications relying on this package.
Vulnerability Detail
The vulnerability in the Micromatch package arises from the use of a greedy regular expression pattern .* in the micromatch.braces() function. This pattern can cause excessive backtracking when processing certain malicious inputs, leading to significant performance degradation or application hang. The issue is exacerbated as the input size increases, making it crucial for developers to address this vulnerability promptly to avoid potential service disruptions.
How To Fix
Minimum fixed version
4.0.7+~4.0.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-micromatchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider using a safer pattern that avoids greedy matching. For example, instead of using .*, you can use a more specific pattern that limits the scope of matching, thus reducing the risk of backtracking issues.
Conclusion
The Micromatch package has a critical vulnerability that can lead to Regular Expression Denial of Service. It is essential for developers to update to version 4.0.8 or later to mitigate this risk. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for node-micromatch →
FAQ
The vulnerability is a Regular Expression Denial of Service (ReDoS) that can cause applications to hang or slow down due to excessive backtracking in regex processing.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities. Check your application against the vulnerability using the Vulert playground without any signup.
If left unaddressed, the vulnerability can lead to application downtime, degraded performance, and a poor user experience, potentially affecting business operations.
Yes, version 4.0.8 and later of the Micromatch package has the vulnerability fixed and is safe to use.
Run the command npm install micromatch@4.0.8 in your terminal to update to the patched version. Ensure to check your package-lock.json for consistency.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-micromatch.
