Executive brief
fast-xml-parser is a popular Node.js library for parsing XML data. The library contains a regular expression flaw in its experimental currency parsing feature that allows an attacker to craft specially formatted input to consume excessive CPU resources, causing a denial of service that can make an application unresponsive or crash.
Technical details
A ReDoS (regular expression denial of service) vulnerability exists in the currency.js module's regex pattern used to parse currency values in version 5 (experimental). An attacker can provide input consisting of many tab characters followed by a period (e.g., '\t'.repeat(13337) + '.') which triggers catastrophic backtracking in the regex engine, consuming excessive CPU cycles. The vulnerability affects versions 4.2.4 through 4.4.0. No authentication or user interaction is required; the vulnerability is triggered whenever untrusted input is processed by the currency parser. The issue has been patched in version 4.4.1.
Affected products
- NaturalIntelligence fast-xml-parser 4.2.4 through 4.4.0
Timeline
- 2024-07-29: disclosed
- 2024-07-29: patched: Patched in version 4.4.1