Executive brief
The fresh library is an HTTP caching utility used in Node.js applications to manage HTTP cache headers and validate freshness. When parsing specially crafted user input, the library's regular expression engine can be exploited to consume excessive CPU resources, causing service slowdown or complete unavailability (denial of service).
Technical details
The vulnerability is a regular expression denial of service (ReDoS) flaw triggered when the fresh library parses user-supplied input containing specially crafted patterns. The vulnerable regex patterns fail to handle certain inputs efficiently, causing catastrophic backtracking in the regex engine. This is a network-reachable flaw requiring no authentication or user interaction—an attacker can send malicious HTTP headers or request payloads to trigger the regex engine to consume excessive CPU and memory. The impact is availability loss (DoS). The vulnerability was fixed in version 0.5.2 and later.
Affected products
- npm fresh < 0.5.2
Timeline
- 2018-07-24: disclosed