Executive brief
detect-character-encoding is a Node.js library that identifies the character encoding of input data. When processing certain malformed input that matches no known charset, the library crashes the entire Node.js process, causing denial of service. Any application using this library to handle untrusted input over the network is vulnerable.
Technical details
The vulnerability is an improper exception handling issue (CWE-755) in detect-character-encoding versions prior to 0.7.0. When the library receives binary data that does not match any recognized charset, it fails to properly handle the exceptional condition and throws an unhandled exception that crashes the Node.js process. The attack vector is network-based with no authentication or user interaction required. An attacker can send specially crafted binary data (such as the single byte \xAA) to any application that passes untrusted input directly to the library, causing immediate denial of service. The fix is available in version 0.7.0 and later.
Affected products
- sonicdoe detect-character-encoding <0.7.0
Timeline
- 2021-08-24: disclosed
- 2021-08-24: patched: Fixed in version 0.7.0