Executive brief
jsdiff is a JavaScript library used to compute and display text differences between files or strings. A Regular Expression Denial of Service (ReDoS) vulnerability in the patch header parser can cause the application to hang or become unresponsive when processing specially crafted input, potentially disrupting services that rely on this library.
Technical details
A ReDoS vulnerability exists in the patch header parser of jsdiff versions before 3.5.0, caused by an inefficient regular expression pattern (CWE-400). The vulnerability can be triggered by an attacker providing malicious patch data containing a crafted string that causes catastrophic backtracking in the regex engine. The attack requires network-accessible input or the ability to provide data to the application using the library; no authentication is needed. Successful exploitation causes CPU exhaustion and unresponsiveness—testing showed approximately 10 seconds of matching time for a 48KB payload. The fix is available in jsdiff version 3.5.0 and later, which optimizes the patch header parser regex.
Affected products
- jsdiff jsdiff before 3.5.0
Timeline
- 2019-06-13: disclosed: Advisory published
- 2019-06-13: patched: Fix available in version 3.5.0