Executive brief
express-fileupload is a Node.js library that handles file uploads in web applications. Versions prior to 1.1.6-alpha.6 contain a flaw that causes the server to delay responses for up to 30 seconds when processing requests with large filenames containing many dot characters. An attacker can exploit this by sending specially crafted upload requests to temporarily exhaust server responsiveness and degrade service for legitimate users.
Technical details
The vulnerability is a denial-of-service condition caused by inefficient processing of filenames containing a large number of dot (.) characters. When express-fileupload processes such filenames, it exhibits significant performance degradation, causing server response delays of up to 30 seconds in testing. The flaw is triggered during the normal request handling path with no authentication or special preconditions required; any network-reachable endpoint using vulnerable versions is susceptible. An attacker can craft HTTP requests with large dot-filled filenames to repeatedly trigger delays and degrade service availability. The vulnerability was fixed in version 1.1.6-alpha.6 and later; upgrading resolves the issue.
Affected products
- express-fileupload prior to 1.1.6-alpha.6
Timeline
- 2020-09-03: disclosed