Executive brief
jadedown is a Node.js templating library that processes user input to generate output. The package contains a regular expression flaw that causes excessive CPU consumption when processing specially crafted input, potentially blocking application processing for seconds at a time with minimal input.
Technical details
This vulnerability is a regular expression denial of service (ReDoS) flaw in the jadedown templating library. The vulnerable regex pattern exhibits catastrophic backtracking when processing certain input sequences, particularly strings composed of repeating characters followed by specific delimiters. An attacker can craft small payloads (48 characters demonstrated) that trigger 5+ seconds of processing time, causing application unavailability. The package is unmaintained since 2011 and has no patched versions available; mitigation requires refactoring dependent applications to avoid using this module.
Affected products
- jadedown jadedown <=0.0.3
Timeline
- 2015-10-24: disclosed: Vulnerability identified
- 2015-10-24: other: Maintainers notified
- 2015-10-25: other: Response from maintainers with intent to fix
- 2016-01-05: advisory: Advisory published
- 2016-01-11: other: CVE requested
- 2019-02-18: advisory: Published to GitHub Advisory Database