Executive brief
parse-link-header is an npm library used to parse HTTP Link headers. A regular expression in the library's checkHeader function can be exploited to cause excessive CPU consumption, allowing an attacker to degrade application performance or trigger denial of service with specially crafted input.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting the checkHeader function in parse-link-header prior to version 2.0.0. The root cause is an unoptimized regular expression that exhibits catastrophic backtracking when processing certain input patterns. Attack is network-accessible and requires no authentication; an attacker can send a malicious Link header to trigger uncontrolled CPU consumption. The fix, released in version 2.0.0, limits the length of the input header and throws an error if the limit is exceeded, preventing ReDoS exploitation.
Affected products
- parse-link-header parse-link-header before 2.0.0
Timeline
- 2021-12-24: disclosed: Published on NVD
- 2022-01-06: patched: Version 2.0.0 released with fix