Executive brief
detect-character-encoding is a Node.js library used to automatically identify the character encoding of text data. A memory leak in the library causes allocated resources to never be released when processing data, allowing an attacker to exhaust server memory through repeated requests and cause a denial of service.
Technical details
The vulnerability is a memory leak (CWE-401) in detect-character-encoding v0.3.0 and earlier, where the ICU charset detector object created during encoding detection is not properly closed after use. The vulnerable component is the charsetDetector in icuWrapper.cpp, which wraps the ICU library's charset detection API. The root cause is missing calls to ucsdet_close(), which is required to release all resources owned by the detector object. An attacker can exploit this via network by sending repeated requests to an application using the library (no authentication or user interaction required), causing the Node.js process to accumulate memory until it crashes and becomes unavailable. The fix was patched in version 0.3.1 by adding proper resource cleanup.
Affected products
- sonicdoe detect-character-encoding 0.3.0 and earlier
Timeline
- 2021-08-31: disclosed: Vulnerability disclosed in GitHub advisory
- 2021-03-10: patched: Fix merged and released in v0.3.1
- 2021-09-01: advisory: CVE-2021-39176 and GHSA-5rwj-j5m3-3chj published
References
- https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-5rwj-j5m3-3chj
- https://github.com/sonicdoe/detect-character-encoding/pull/6
- https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588
- https://github.com/sonicdoe/detect-character-encoding
- https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1