Executive brief
The content npm package is a Node.js library for parsing HTTP headers. A regular expression denial of service (ReDoS) vulnerability allows an attacker to send malicious Content-Type or Content-Disposition headers that cause the library to consume excessive CPU resources, potentially freezing or crashing applications that depend on it.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) in the content npm package, affecting versions prior to 3.0.7. The root cause is an uncontrolled resource consumption weakness (CWE-400) in the regular expressions used to parse Content-Type and Content-Disposition HTTP headers. An unauthenticated attacker on the network can send specially crafted header values that cause catastrophic backtracking in the regex engine, leading to excessive CPU consumption and denial of service. The attack requires no user interaction and the vulnerable component is directly exposed to any HTTP client. A patch is available in version 3.0.7 and later.
Affected products
- npm content all versions prior to 3.0.7
Timeline
- 2018-07-24: disclosed
- 2018-07-24: patched: Fixed in version 3.0.7