esm regular expression denial of service in find-indexes

Executive brief

The esm JavaScript module loader contains a regular expression parsing bug that can cause infinite loops or memory exhaustion when processing certain identifier patterns. An attacker who can control module imports (e.g., through malicious code or a dependency) can trigger this condition, causing the application to hang or crash and disrupting service availability.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in esm's find-indexes module, which constructs regex patterns from unescaped identifiers. When special regex metacharacters like ' are used as import identifiers, they create malformed patterns (e.g. '\b(?:S|$)\b' instead of '\b(?:S|\$)\b') that match zero-width positions, causing infinite loops in subsequent regex matching operations. The vulnerability affects all versions prior to 3.1.0 and requires the ability to control or influence module import statements. The fix, applied in version 3.1.0, properly escapes identifiers before including them in regex patterns.

Affected products

• standard-things esm before 3.1.0

Timeline

• 2018-12-23: disclosed: Issue reported on GitHub
• 2019-06-20: patched: Version 3.1.0 released with fix using escapeRegExp()
• 2019-06-20: advisory: GHSA-qx4v-6gc5-f2vv published

References

• https://github.com/standard-things/esm/issues/694
• https://github.com/standard-things/esm/commit/c41e001d81a5a52b0d2d1722b1c2af04d997c05b