Executive brief
domain-suffix is a Node.js library used to parse domain suffixes from URLs. A regular expression in the library is vulnerable to catastrophic backtracking when processing specially crafted input strings, allowing an attacker to cause the application to hang indefinitely and consume CPU resources, effectively denying service to legitimate users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the regex pattern at line 28 of domainSuffix.ts. When the parse function receives a long string without a forward slash character (or with a specially crafted pattern), the regex engine performs excessive backtracking, causing the function to hang for extended periods. The vulnerability is triggered by network-accessible input to the parse function with no authentication required. An attacker can crash or severely degrade the availability of applications using this library by sending crafted URLs. All versions up to 1.0.8 are affected; a patch or updated version addressing the regex pattern is likely available in the upstream repository.
Affected products
- npm domain-suffix 1.0.8 and all previous versions
Timeline
- 2024-03-27: disclosed: Vulnerability reported to NVD
- 2024-03-28: advisory: GHSA-cqfh-c4c5-c2hg advisory published