Executive brief
html-minifier is a widely used library for compressing HTML markup to reduce file sizes in web applications. A regular expression denial-of-service (ReDoS) flaw in the library's reCustomIgnore regex allows attackers to craft malicious HTML input that causes the minifier to hang or consume excessive CPU resources, potentially disrupting build pipelines and deployment processes.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the reCustomIgnore regular expression within kangax html-minifier versions up to and including 4.0.0. The vulnerable regex pattern causes catastrophic backtracking when processing specially crafted HTML input, allowing an attacker to trigger exponential algorithmic complexity. The vulnerability is in the htmlminifier.js file and can be exploited by supplying malicious HTML to any process using the library to minify content. No authentication is required; the attack is triggered simply by processing hostile input. An attacker can cause denial of service by exhausting CPU resources on systems running the minifier, affecting build pipelines, deployment systems, and any application that minifies user-supplied HTML.
Affected products
- kangax html-minifier 4.0.0 and earlier
Timeline
- 2022-10-31: disclosed: Vulnerability published
- 2022-10-31: other: CVE-2022-37620 assigned