Executive brief
cookiejar is a Node.js library used for parsing and managing HTTP cookies in applications. A regular expression flaw in the Cookie.parse function can cause applications to hang or become unresponsive for extended periods when processing specially crafted cookie values, potentially disrupting service availability for users.
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability in the cookiejar library's Cookie.parse function and related parsing APIs. The vulnerability exists due to an insecure regular expression pattern used to parse cookie values, allowing an attacker to trigger catastrophic backtracking. The attack vector is network-based, requiring no authentication; an attacker can supply malicious cookie values through HTTP headers or direct API calls. Untrusted input passed to cookie parsing functions causes the regex engine to consume excessive CPU resources, stalling the application. The fix is available in version 2.1.4, where parsing protections including length guards on cookie values were implemented.
Affected products
- cookiejar cookiejar before 2.1.4
Timeline
- 2023-01-18: disclosed
- 2022-12-13: patched: Fix merged in pull request #39