Executive brief
fast-string-search is a Node.js library for high-performance substring searching. Attackers can trigger a denial of service by passing non-string inputs to the search function, causing the V8 engine to read from invalid memory locations and crash the application. This can make services unavailable with minimal effort, since no authentication or user interaction is required.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400, CWE-682) in fast-string-search's N-API implementation. When non-string inputs are passed to functions like indexOfSkip(), the native code performs incorrect computations on buffer pointers, causing V8 to attempt reading from non-permitted memory locations and triggering a segmentation fault. The attack vector is network-accessible if the library is used in a web service; exploitation requires no authentication or privileges. An attacker can immediately crash the service by calling indexOfSkip(1, 1) or similar with non-string arguments, or trigger a prolonged DoS through resource exhaustion before the crash occurs. All versions up to 1.4.3 are affected, and no patched version is available.
Affected products
- fast-string-search developers fast-string-search all versions up to 1.4.3
Timeline
- 2022-02-03: disclosed
- 2022-06-18: advisory