Executive brief
ircdkit is a Node.js library for building IRC (Internet Relay Chat) servers. A remote attacker can crash the server by abruptly closing a network connection, causing an unhandled exception and service outage.
Technical details
The vulnerability is a denial of service caused by an unhandled connection 'end' event (CWE-400: Uncontrolled Resource Consumption). When a client disconnects abruptly (e.g., via netcat or network disruption), the library attempts to remove the connection but fails to properly handle the socket cleanup, throwing an uncaught exception. The attack requires network access to the IRC server and no authentication or preconditions; a simple connection followed by immediate disconnection triggers the crash. The fix, available in version 1.0.4, properly handles the 'end' event by checking socket state before removal.
Affected products
- ircdkit ircdkit 1.0.3 and prior
Timeline
- 2018-11-03: disclosed: Issue #1 opened on GitHub
- 2019-05-31: patched: Fix merged in PR #2; version 1.0.4 released
- 2019-06-03: advisory: GHSA-f7r3-p866-q9qr published