Executive brief
devcert is an npm package used to create locally-trusted development certificates for HTTPS testing. A regular expression denial of service (ReDoS) vulnerability allows attackers to supply malicious input to the certificateFor method, causing the application to hang or consume excessive CPU resources and disrupting development workflows.
Technical details
An exponential ReDoS vulnerability exists in devcert's domain validation logic, where a vulnerable regular expression (VALID_DOMAIN) processes untrusted input without proper bounds checking. The attack is triggered when an attacker can supply arbitrary input to the certificateFor method, causing the regex engine to enter catastrophic backtracking. This results in denial of service via CPU exhaustion. The vulnerability was fixed in version 1.2.1 by replacing the vulnerable regex pattern with the is-valid-domain library.
Affected products
- npm devcert all versions before 1.2.1
Timeline
- 2022-06-03: disclosed: Published to GitHub Advisory Database
- 2022-06-02: patched: Fix committed to repository (version 1.2.1)