Regular Expression Denial of Service in nwmatcher
Summary
GHSA-6394-6h9h-cfjg: Regular Expression Denial of Service. Affects nwmatcher versions < 1.4.4. Fixed in 1.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nwmatcher is an npm package that provides a fast and efficient way to query and manipulate DOM elements. It is commonly used in web development projects to enhance the functionality of websites. However, a vulnerability has been discovered in versions prior to 1.4.4 that could potentially lead to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The vulnerability in nwmatcher is related to a regular expression pattern used in the code. An attacker can exploit this vulnerability by providing a specially crafted input that triggers excessive backtracking in the regular expression engine. This can cause the application to consume excessive CPU resources, leading to a denial of service condition. The impact of this vulnerability can range from degraded performance to complete unavailability of the affected application.
How To Fix
Minimum fixed version
1.4.4
This is the first release that contains the fix.
npm install nwmatcher@1.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating nwmatcher is not immediately feasible, a temporary workaround can be implemented by manually modifying the vulnerable code. The following code snippet demonstrates the necessary modification:
// Replace the vulnerable regular expression pattern
const modifiedPattern = /\s*/g;
// Use the modified pattern in the code
// ... (affected code using the pattern)
Conclusion
The Regular Expression Denial of Service vulnerability in nwmatcher can be mitigated by updating the package to version 1.4.4 or later. If immediate update is not possible, a temporary workaround can be applied by modifying the vulnerable code. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nwmatcher →
FAQ
nwmatcher is an npm package that provides a fast and efficient way to query and manipulate DOM elements in web development projects.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack where an attacker exploits a vulnerability in a regular expression pattern to cause excessive backtracking, leading to a significant consumption of CPU resources and potentially rendering the affected application unresponsive.
The impact of this vulnerability can range from degraded performance to complete unavailability of the affected application. It depends on the specific circumstances and the resources available to the attacker.
To fix this vulnerability, it is recommended to update nwmatcher to version 1.4.4 or later. This update includes a fix that addresses the vulnerability by replacing the problematic regular expression pattern.
Yes, if updating nwmatcher is not immediately feasible, a temporary workaround can be implemented by manually modifying the vulnerable code. Refer to the 'workaround' section for more details.
