Executive brief
fast-string-search is a Node.js module used to rapidly find substrings within strings. A memory handling flaw allows attackers to read previously allocated memory when the library receives non-string input, potentially exposing sensitive data from the application's memory space.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) caused by incorrect memory freeing and length calculation when processing non-string input. When a caller passes data types other than strings to the indexOf function, the library miscalculates memory boundaries, allowing read access to adjacent allocated memory. The flaw is in the native N-API binding layer (fast-string-search.c). No authentication or special privileges are required; any application using this library with untrusted input is vulnerable. An attacker can exploit this to leak sensitive data from memory. The library has been archived and versions up to 1.4.3 are affected.
Affected products
- magiclen fast-string-search up to 1.4.3
Timeline
- 2022-06-18: disclosed
- 2022-06-17: advisory