Executive brief
nwmatcher is a JavaScript CSS selector matching library used in web applications. A regular expression vulnerability could allow an attacker to send specially crafted input that causes the parser to consume excessive CPU resources, leading to application slowdown or temporary unavailability.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by catastrophic backtracking in regex patterns. Specifically, multiple repeated instances of the "\s*" (whitespace zero or more times) pattern in the CSS selector parsing regular expressions could be exploited by an attacker sending specially crafted selector input. The fix involved replacing "\s*" with "\s?" (whitespace zero or one time) to reduce backtracking complexity. The vulnerability affects all versions before 1.4.4 and is exploitable via network if the application processes untrusted CSS selectors.
Affected products
- nwmatcher nwmatcher before 1.4.4
Timeline
- 2019-06-07: disclosed
- 1.4.4: patched