Executive brief
@commercial/subtext is a Node.js library for handling HTTP request payloads and file uploads. Versions before 5.1.1 fail to enforce maximum payload size limits on chunked uploads, allowing attackers to send arbitrarily large requests that exhaust disk space and system memory, causing the application to become unavailable.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-400) in @commercial/subtext's payload handling logic. The maxBytes configuration parameter is not properly enforced for HTTP requests with chunked transfer encoding that are written to the file system, allowing an unauthenticated network attacker to send unbounded payload sizes. An attacker can exploit this by sending requests with chunked encoding to exhaust available disk space or system memory, resulting in denial of service. The vulnerability is fixed in version 5.1.1 and later.
Affected products
- commercial @commercial/subtext before 5.1.1
Timeline
- 2020-09-03: disclosed