Junglewise Threat Intelligence

CVE-2021-23346: html-parse-stringify regular expression denial of service

CVE-2021-23346 · Severity: low · CVSS 3.1 · Published 2021-03-18

Vendors: npm.

Executive brief

html-parse-stringify and html-parse-stringify2 are JavaScript libraries used to parse and convert HTML content in web applications. A flaw in the HTML tag parsing regex causes the parser to hang indefinitely when processing specially crafted input, allowing an attacker to freeze the application and disrupt service availability.

Technical details

The vulnerability is a regular expression denial of service (ReDoS) in the HTML tag parsing regex used by both html-parse-stringify and html-parse-stringify2 libraries. The vulnerable regex exhibits catastrophic backtracking when processing malformed input such as sequences of single quotes preceded by a less-than symbol (e.g., `<!''''''...`). The vulnerability is triggered when untrusted HTML input is parsed, and no special privileges or user interaction are required—if the library processes external or user-supplied HTML, an attacker can cause the parsing process to hang indefinitely, denying service. The fix, released in html-parse-stringify v2.0.1, involves modifying the regex pattern to eliminate the backtracking vulnerability. html-parse-stringify2 remains unfixed as of the advisory date.

Affected products

  • npm html-parse-stringify < 2.0.1
  • npm html-parse-stringify2 all versions

Timeline

  • 2021-03-04: disclosed: Vulnerability publicly disclosed; NVD published
  • 2021-02-26: patched: html-parse-stringify v2.0.1 released with regex fix
  • 2021-03-18: advisory: GitHub Security Advisory GHSA-545q-3fg6-48m7 published

References