Executive brief
Vercel's ms library is a widely-used utility for parsing and converting time values in JavaScript applications. An attacker can exploit a weakness in the parsing logic by providing maliciously crafted input that causes excessive computation, potentially causing the application to hang or become unresponsive. While the immediate impact is availability degradation rather than data theft, this can disrupt services and affect user experience.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) flaw in the parse function of the ms library (CWE-1333). The root cause is an inefficient regular expression that exhibits catastrophic backtracking when given specially crafted input strings. An attacker can remotely trigger this by sending input designed to cause regex processing to take ~0.3 seconds or more, achieving a denial-of-service effect. The vulnerability affects ms versions up to 1.x; the patch (commit caae2988ba2a37765d055c4eee63d383320ee662) was merged in 2017 and released in version 2.0.0, which limits input string length to prevent the condition.
Affected products
- Vercel ms up to 1.x
Timeline
- 2023-01-05: disclosed: Published as GHSA-w9mr-4mfr-499f
- 2.0.0: patched: Patch released with input length limit to 100 characters