Executive brief
Centra is a lightweight HTTP client library for Node.js used to make requests to external web services. When not in stream mode, the library buffers entire HTTP responses into memory without any size limit, allowing an attacker serving malicious content to exhaust memory and crash applications that depend on centra. This affects any application using centra to fetch content from untrusted sources.
Technical details
The vulnerability is a classic buffer overflow / unbounded memory allocation issue (CWE-119) in the response buffering logic. When centra receives HTTP responses in non-stream mode, it accumulates the entire response body in memory without enforcing any size constraints. An attacker controlling a remote server can send an arbitrarily large response, causing the Node.js process to consume memory until it crashes, resulting in denial of service. The vulnerability requires only network reachability to an affected application making requests to the attacker's server; no authentication or user interaction is needed. Version 2.4.0 and later patch the issue by implementing a maximum buffer size limit for response bodies.
Affected products
- ethanent centra <2.4.0
Timeline
- 2019-09-30: disclosed: Published to GitHub Advisory Database