Executive brief
lambda-middleware is a Node.js library providing middleware utilities for AWS Lambda functions. An inefficient regular expression in the JSON deserializer component can cause denial of service when processing specially crafted input, reducing API availability until the Lambda function times out or is manually restarted.
Technical details
The vulnerability is an inefficient regular expression complexity issue (CWE-1333) in the JSON Mime-Type Handler component of the @lambda-middleware/json-deserializer package. The vulnerable code is located in packages/json-deserializer/src/JsonDeserializer.ts and affects versions prior to 1.1.0. An attacker can supply malicious JSON input that causes catastrophic backtracking in the regex pattern, leading to excessive CPU consumption and denial of service. The attack vector is network-based with low complexity and requires low privileges. The vulnerability has been fixed in version 1.1.0 (patch commit f689404d830cbc1edd6a1018d3334ff5f44dc6a6).
Affected products
- dbartholomae @lambda-middleware/json-deserializer <1.1.0
Timeline
- 2024-02-12: disclosed
- 2024-02-12: patched: Fixed in version 1.1.0