Junglewise Threat Intelligence

CVE-2015-8315: Vercel ms ReDoS in Node.js package

CVE-2015-8315 · Severity: high · CVSS 7.5 · Published 2017-01-23

Vendors: Vercel.

Executive brief

The 'ms' library, a popular utility for converting time strings to milliseconds in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted, extremely long time string that causes the application to consume excessive CPU resources while trying to process it. This can lead to the application becoming unresponsive or crashing, potentially disrupting business operations and service availability.

Technical details

The 'ms' package (versions prior to 0.7.1) contains a Regular Expression Denial of Service (ReDoS) vulnerability (CWE-1333). The root cause is an inefficient regular expression used to parse time strings into milliseconds. An unauthenticated remote attacker can exploit this by providing a maliciously crafted, long input string (e.g., thousands of characters followed by a specific suffix), causing the regex engine to enter a state of catastrophic backtracking. This results in 100% CPU utilization and can hang the Node.js event loop, leading to a complete denial of service for the affected application. The issue is fixed in version 0.7.1.

Affected products

  • Vercel ms < 0.7.1

Timeline

  • 2015-11-25: disclosed: Vulnerability identified/CVE assigned
  • 2017-01-23: advisory: NVD published date
  • 2017-10-24: advisory: GitHub Advisory published

References

Related threats