Executive brief
yar is a Node.js session management library used to handle user sessions in web applications. A vulnerability in versions prior to 2.2.0 causes the application process to crash when it receives an invalid encrypted session cookie, allowing an attacker to trigger a denial of service and disrupt service availability for all users.
Technical details
The vulnerability is a crash-inducing denial of service (CWE-400: Uncontrolled Resource Consumption) in yar's session cookie handling. When the library processes an invalid encrypted session cookie value, it fails to handle the error gracefully and instead crashes the process. The attack vector is network-based with no authentication or user interaction required—an attacker can simply send a crafted HTTP request with a malformed cookie. The impact is immediate process termination, causing service outage. The vulnerability is fixed in version 2.2.0 and later.
Affected products
- spumko yar prior to 2.2.0
Timeline
- 2020-09-01: disclosed
- 2.2.0: patched