Executive brief
The slug npm package is a library used to convert strings into URL-friendly identifiers. A flaw in its regular expression parsing allows an attacker to supply a specially crafted input string that causes the application to consume excessive CPU resources and freeze, potentially making services relying on this library unresponsive. Exploitation requires approximately 50,000 characters to block event loop for several seconds.
Technical details
A regular expression denial of service (ReDoS) vulnerability exists in the slug package's input parsing logic. The vulnerable regex pattern /^\s+|\s+$/g exhibits catastrophic backtracking when processing untrusted input with certain character patterns. An attacker can craft a 50,000+ character payload to cause the regex engine to consume significant CPU, blocking the Node.js event loop for approximately 2 seconds. While the precondition requires the application to process attacker-controlled input through the slug function, no authentication or network-level bypass is required. The vulnerability was patched in version 0.9.2.
Affected products
- npm slug <= 0.9.1
Timeline
- 2017-09-06: disclosed
- 2018-07-24: patched: Fixed in version 0.9.2