Denial of Service in node-sass
Summary
GHSA-9v62-24cr-58cx: Denial of Service in node-sass. Affects node-sass versions >= 3.3.0, < 4.13.1. Fixed in 4.13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-sass is an open-source library that provides binding to LibSass, a popular CSS preprocessor. It allows developers to compile Sass files into CSS. Node-sass is widely used in the Node.js ecosystem for its performance and compatibility with existing Sass codebases. However, certain versions of node-sass are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in node-sass arises from a flaw in the handling of crafted objects passed to the renderSync function. This flaw triggers C++ assertions in the CustomImporterBridge::get_importer_entry and CustomImporterBridge::post_process_return_value functions, leading to a crash of the Node.js process. An attacker can exploit this vulnerability to crash the system's running Node.js process, resulting in a Denial of Service. The impact of this vulnerability can disrupt the availability of the affected application or system.
How To Fix
Minimum fixed version
4.13.1
This is the first release that contains the fix.
npm install node-sass@4.13.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
In conclusion, the vulnerability in node-sass can be exploited to cause a Denial of Service by crashing the Node.js process. To mitigate this vulnerability, it is crucial to upgrade to version 4.13.1 or later. Failure to address this vulnerability may result in service disruptions and potential exploitation by attackers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-sass →
FAQ
Node-sass is a library that allows developers to compile Sass files into CSS using LibSass, a popular CSS preprocessor.
The vulnerability can lead to a Denial of Service, causing the Node.js process to crash and potentially disrupting the availability of the affected application or system.
To fix this vulnerability, upgrade to version 4.13.1 or later of node-sass.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to vulnerability details]
References
Related vulnerabilities
Recent vulnerabilities recorded for node-sass.
