Junglewise Threat Intelligence

ircdkit denial of service via unhandled connection end event

Severity: low · CVSS 3.1 · Published 2019-06-03

Vendors: npm.

Executive brief

ircdkit is a Node.js library for building IRC (Internet Relay Chat) servers. A remote attacker can crash the server by abruptly closing a network connection, causing an unhandled exception and service outage.

Technical details

The vulnerability is a denial of service caused by an unhandled connection 'end' event (CWE-400: Uncontrolled Resource Consumption). When a client disconnects abruptly (e.g., via netcat or network disruption), the library attempts to remove the connection but fails to properly handle the socket cleanup, throwing an uncaught exception. The attack requires network access to the IRC server and no authentication or preconditions; a simple connection followed by immediate disconnection triggers the crash. The fix, available in version 1.0.4, properly handles the 'end' event by checking socket state before removal.

Affected products

  • ircdkit ircdkit 1.0.3 and prior

Timeline

  • 2018-11-03: disclosed: Issue #1 opened on GitHub
  • 2019-05-31: patched: Fix merged in PR #2; version 1.0.4 released
  • 2019-06-03: advisory: GHSA-f7r3-p866-q9qr published

References