Junglewise Threat Intelligence

CVE-2024-41818: fast-xml-parser regular expression denial of service in currency parsing

CVE-2024-41818 · Severity: low · CVSS 3.1 · Published 2024-07-29

Technologies: fast-xml-parser (npm). Vendors: npm.

Executive brief

fast-xml-parser is a popular Node.js library for parsing XML data. The library contains a regular expression flaw in its experimental currency parsing feature that allows an attacker to craft specially formatted input to consume excessive CPU resources, causing a denial of service that can make an application unresponsive or crash.

Technical details

A ReDoS (regular expression denial of service) vulnerability exists in the currency.js module's regex pattern used to parse currency values in version 5 (experimental). An attacker can provide input consisting of many tab characters followed by a period (e.g., '\t'.repeat(13337) + '.') which triggers catastrophic backtracking in the regex engine, consuming excessive CPU cycles. The vulnerability affects versions 4.2.4 through 4.4.0. No authentication or user interaction is required; the vulnerability is triggered whenever untrusted input is processed by the currency parser. The issue has been patched in version 4.4.1.

Affected products

  • NaturalIntelligence fast-xml-parser 4.2.4 through 4.4.0

Timeline

  • 2024-07-29: disclosed
  • 2024-07-29: patched: Patched in version 4.4.1

References

Related threats