Executive brief
tmpl is a Node.js library used for simple string formatting and template interpolation. An attacker can provide a maliciously crafted template string with unbalanced braces that causes the template engine's regular expression to consume excessive CPU resources, effectively creating a denial-of-service condition that can freeze or crash applications using the library.
Technical details
tmpl contains a regular expression denial-of-service (ReDoS) vulnerability in its template interpolation regex pattern. The vulnerable regex pattern uses `/{\s*\S*+?}/g`, which can experience catastrophic backtracking when processing input with many unmatched opening braces. This is a CWE-400 uncontrolled resource consumption issue (inefficient regex complexity). An attacker can exploit this by submitting a template string with carefully crafted input to cause the regex engine to consume excessive CPU, resulting in denial of service. The vulnerability was fixed in version 1.0.5 by changing the pattern to `/{{[^{]+?}}/g` to prevent pathological backtracking. No authentication or special privileges are required to trigger the vulnerability—any code that processes untrusted template input is affected.
Affected products
- nodejs-tmpl tmpl before 1.0.5
Timeline
- 2021-09-15: disclosed: CVE-2021-3777 published on NVD
- 2021-09-20: patched: GHSA advisory published; fix available in version 1.0.5