Executive brief
negotiator is a popular Node.js library that handles HTTP content negotiation, including parsing Accept-Language headers. An attacker can craft a specially-formatted Accept-Language header that causes the library's regex parser to consume excessive CPU time, potentially making web services unavailable to legitimate users.
Technical details
negotiator versions before 0.6.1 contain a regular expression denial of service (ReDoS) vulnerability in their Accept-Language header parsing logic. The vulnerability is triggered when a specially crafted Accept-Language header is processed, causing the regex engine to enter catastrophic backtracking and consume excessive CPU resources. The attack is network-reachable and requires no authentication—an attacker simply sends a malicious HTTP request with a crafted Accept-Language header to any web application using the vulnerable negotiator library. This can lead to application slowdown or complete denial of service. The fix was released in version 0.6.1.
Affected products
- negotiator negotiator before 0.6.1
Timeline
- 2018-10-09: disclosed
- 2016: patched: Fix released in version 0.6.1