Executive brief
chrono-node is a JavaScript library used to parse natural language date and time expressions. A vulnerability in its regex-based date parsing logic causes the application to hang indefinitely when processing certain malformed date strings with many embedded spaces, leading to a denial of service that can disrupt application availability.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) caused by catastrophic backtracking in the date string parsing logic. When the parse() method receives a date-like string with numerous embedded spaces (e.g., "BGR3 186 days 18 hours 37 minutes 01 seconds"), the regex engine enters an exponential-time backtracking loop and never returns. This occurs in chrono-node versions before 2.2.4 and is network-reachable if the library processes untrusted input. An attacker can exploit this to cause application hangs and denial of service. A patch is available in version 2.2.4 and later.
Affected products
- chrono-node chrono-node before 2.2.4
Timeline
- 2021-03-07: disclosed: Issue reported on GitHub
- 2021-05-06: advisory: GHSA advisory published
- 2021: patched: Fixed in version 2.2.4