Executive brief
npm ssri is a library that processes Subresource Integrity (SRI) hashes used to verify downloaded packages and resources. A flaw in its regular expression parsing allows attackers to submit specially crafted SRI values that consume excessive CPU time, causing denial of service. Applications using the strict validation option are vulnerable.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the SRI parsing regex within npm ssri versions 5.2.2-6.0.1, 7.0.0-8.0.0. The vulnerable regex exhibits catastrophic backtracking when processing malicious SRI input, particularly when the strict option is enabled. An attacker can submit specially crafted SRI hashes that cause the regex engine to spend excessive computational time, leading to denial of service. No authentication is required and the attack is remotely exploitable over the network. Patches are available in versions 6.0.2, 7.1.1, and 8.0.1 with the regex fix committed to the repository.
Affected products
- npm ssri 5.2.2-6.0.1, 7.0.0-8.0.0
Timeline
- 2021-03-19: disclosed
- 2021-03: patched: Patches released in versions 6.0.2, 7.1.1, and 8.0.1