Executive brief
cacheable-request is a Node.js library that manages HTTP caching for requests. A vulnerability in its dependency http-cache-semantics allows attackers to cause a denial of service by sending specially crafted HTTP request headers that trigger inefficient regex processing, potentially freezing or crashing servers relying on this library.
Technical details
This advisory addresses an inefficient regular expression complexity vulnerability (CWE-1333) in the http-cache-semantics dependency used by cacheable-request, affecting all versions prior to 10.2.7. The vulnerability exists in http-cache-semantics versions before 4.1.1, where regex patterns used to parse HTTP cache headers exhibit pathological backtracking behavior. An attacker can exploit this by sending malicious request header values to a server that processes cache policies using this library, triggering denial of service through CPU exhaustion. The issue was fixed in cacheable-request 10.2.7 by updating to the patched http-cache-semantics version.
Affected products
- npm cacheable-request before 10.2.7
Timeline
- 2023-02-11: disclosed
- 2023-02-07: patched: Fixed in cacheable-request 10.2.7
- 2023-02-14: other: Advisory withdrawn