Regular Expression Denial of Service Vulnerability in node-micromatch Package
Summary
UBUNTU-CVE-2024-4067: The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). Affects node-micromatch versions 2.3.11-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-micromatch package is a popular utility in the Node.js ecosystem, used for matching file paths and patterns with high efficiency. It offers features such as brace expansion and supports complex pattern matching, making it a valuable tool for developers. However, it has been found to be vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact application performance.
Vulnerability Detail
The vulnerability arises from the micromatch.braces() function in the package, where the regex pattern '.*' can greedily match any input. When a malicious payload is provided, the regex engine may enter a state of excessive backtracking, leading to increased processing time and potentially causing the application to hang or slow down. This issue is particularly concerning as it can be exploited with relatively simple inputs, making it a significant risk for applications relying on this package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using patterns that include greedy matching, such as '.*', in your applications. Instead, consider using more specific patterns that do not lead to excessive backtracking.
Conclusion
The node-micromatch package is vulnerable to a Regular Expression Denial of Service attack, which can significantly affect application performance. It is crucial to update to version 4.0.8 or later to mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-micromatch →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to application slowdowns or crashes, affecting user experience and system reliability.
Yes, the vulnerability has been patched in version 4.0.8 of the node-micromatch package.
A ReDoS attack exploits the backtracking behavior of regular expressions, causing the application to consume excessive CPU resources and potentially leading to denial of service.
Related vulnerabilities
Recent vulnerabilities recorded for node-micromatch.
