Junglewise Threat Intelligence

CVE-2021-29486: cumulative-distribution-function infinite loop in CDF evaluation

CVE-2021-29486 · Severity: low · CVSS 3.1 · Published 2021-05-04

Vendors: npm.

Executive brief

The cumulative-distribution-function npm library is susceptible to infinite loop attacks when processing string data instead of numeric data. An attacker can supply malformed input (e.g., an array of numeric strings like ["1","2","3"] instead of [1,2,3]) to cause a Node.js server to hang indefinitely or a browser to freeze, effectively denying service to legitimate users. This is particularly dangerous in server environments where a single malicious request can impact all users of that application.

Technical details

The vulnerability is a classic improper input validation flaw (CWE-20) combined with an infinite loop condition (CWE-835) in the cumulative distribution function (CDF) evaluation code. The library fails to validate that input data is numeric type (Array[number]) before processing, instead assuming numeric data as documented. When string data is supplied (e.g., ["1","2","3"]), the comparison logic in the while loop never reaches its exit condition, causing infinite execution. The attack requires no authentication and is network-reachable if the vulnerable library is exposed through a web service. An attacker can trigger a denial-of-service by sending a single request with string-formatted data, causing the entire application process to hang. The vulnerability was patched in version 2.0.0, which adds explicit type checking and throws a TypeError for invalid input data.

Affected products

  • DrPaulBrewer cumulative-distribution-function <=1.0.3

Timeline

  • 2021-04-30: disclosed: Vulnerability disclosed on GitHub advisory GHSA-58qp-5328-v7mh
  • 2021-04-29: patched: Patch released in version 2.0.0

References