Executive brief
The debug library is a widely-used Node.js logging utility. A vulnerability in its string-processing function can be exploited to cause a denial-of-service by triggering catastrophic backtracking in a regular expression, causing the application to hang or consume excessive CPU.
Technical details
This vulnerability (CWE-1333) involves an inefficient regular expression in the useColors function of src/node.js that is susceptible to Regular Expression Denial of Service (ReDoS) attacks. An attacker can supply a specially-crafted string argument that causes the regex engine to experience catastrophic backtracking, resulting in severe performance degradation or denial of service. The vulnerability affects all versions prior to 2.6.9 and versions 3.0.x (fixed in 3.1.0). No authentication or special privileges are required to trigger the issue; an attacker only needs to control the input passed to the affected function. The fix involves replacing the vulnerable regex pattern with a simpler, more efficient implementation.
Affected products
- debug-js debug prior to 2.6.9 and 3.0.x versions (fixed in 3.1.0)
Timeline
- 2023-01-09: disclosed
- 2017-09-21: patched: Fix merged in PR #504; backported to 2.6.9 and released as 3.1.0