ReDoS Vulnerability in Node-Async Package: CVE-2024-39249
Summary
UBUNTU-CVE-2024-39249: Async. Affects node-async versions 0.1.22-2 – 0.2.5-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Async is a popular JavaScript library that provides asynchronous control flow utilities, allowing developers to manage asynchronous operations more effectively. It is widely used in various applications to simplify the handling of asynchronous tasks. However, versions 2.6.4 and 3.2.5 of Node-Async are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can potentially disrupt the functionality of applications relying on this package.
Vulnerability Detail
The vulnerability arises from the parsing function in the autoinject function of Node-Async, which is susceptible to ReDoS attacks. This occurs when an attacker sends specially crafted input that exploits the regular expressions used in the package, leading to excessive backtracking and significant performance degradation. Although the supplier disputes the severity of this vulnerability, claiming there is no realistic threat model, it still poses a risk to applications that process untrusted input.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize any user inputs before they are processed by the Node-Async package. This can help mitigate the risk of ReDoS attacks.
Conclusion
The ReDoS vulnerability in the Node-Async package (CVE-2024-39249) poses a risk to applications that rely on this library for asynchronous operations. It is crucial to update to a patched version or implement input validation to protect against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-async →
FAQ
A ReDoS (Regular Expression Denial of Service) attack exploits the way regular expressions are processed, causing excessive backtracking and slowing down or crashing the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Versions 2.6.4 and 3.2.5 of Node-Async are known to be vulnerable to this ReDoS attack.
Yes, it is recommended to update to a patched version of Node-Async to mitigate this vulnerability.
If you cannot update the package right away, implement input validation to sanitize user inputs as a temporary workaround.
