Executive brief
The mime library is a widely-used Node.js package that identifies file types based on filenames or content. When processing untrusted user input (such as filenames), the library's pattern-matching code can be forced to consume excessive CPU resources, causing application slowdowns or crashes. An attacker can trigger this by providing specially crafted input, disrupting service availability for legitimate users.
Technical details
This vulnerability is a regular expression denial of service (ReDoS) affecting the mime library's MIME type lookup functionality. The vulnerable regex patterns are triggered when mime attempts to match user-supplied input, such as filenames, against its type definitions. The attack requires only network-level access to a system that performs mime lookups on untrusted data and does not require authentication or user interaction. An attacker can craft malicious input strings that cause the regex engine to perform catastrophic backtracking, consuming significant CPU and degrading or denying service. The vulnerability was fixed in mime version 1.4.1 and 2.0.3 or later.
Affected products
- mime mime 0 to 1.4.0 and 2.0.0 to 2.0.2
Timeline
- 2018-07-20: disclosed
- 2017: patched: Fixes available in mime 1.4.1 and 2.0.3+