Quick answers
- Is CVE-2024-41818 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-41818 being exploited in the wild.
- How severe is CVE-2024-41818?
- Low severity, with a CVSS score of 3.1, published 29 July 2024.
- Which products and versions are affected?
- fast-xml-parser (npm) SEMVER:introduced=4.3.5,fixed=4.4.1.
- Is there a fix for CVE-2024-41818?
- Yes. fast-xml-parser (npm): upgrade to 4.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-41818 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-41818?
- Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- fast-xml-parser (npm): upgrade to 4.4.1 or later
npm install fast-xml-parser@4.4.1
Technical details
A ReDoS (regular expression denial of service) vulnerability exists in the currency.js module's regex pattern used to parse currency values in version 5 (experimental). An attacker can provide input consisting of many tab characters followed by a period (e.g., '\t'.repeat(13337) + '.') which triggers catastrophic backtracking in the regex engine, consuming excessive CPU cycles. The vulnerability affects versions 4.2.4 through 4.4.0. No authentication or user interaction is required; the vulnerability is triggered whenever untrusted input is processed by the currency parser. The issue has been patched in version 4.4.1.
Affected products
- NaturalIntelligence fast-xml-parser 4.2.4 through 4.4.0
Identifiers
- CVE-2024-41818
- GHSA-mpg4-rc92-vx8v
Timeline
- 2024-07-29: disclosed
- 2024-07-29: patched: Patched in version 4.4.1