Executive brief
ced is a Node.js library used to detect the character encoding of text data. A vulnerability in version 0.1.0 allows an attacker to crash the entire application process by sending unexpected data types. This results in a denial-of-service (DoS) condition, potentially taking down web services or applications that use this library to process user-supplied input.
Technical details
The ced library (v0.1.0) fails to validate the input type passed to its main function, which expects a Node.js Buffer. When the library receives a non-Buffer type (such as a string or object) and passes it to the underlying C++ bindings (Google's compact_enc_det), the Node.js process terminates unexpectedly. This is classified as improper handling of unexpected data types (CWE-241). An attacker can exploit this remotely if the application passes untrusted network input directly to the library. The issue is fixed in version 1.0.0 by implementing a check using Buffer.isBuffer() and throwing a catchable TypeError instead of crashing the process.
Affected products
- sonicdoe ced 0.1.0
Timeline
- 2021-08-17: advisory: Initial disclosure and NVD publication
- 2021-08-23: patched: GitHub Advisory published and version 1.0.0 released