Executive brief
The sql-injection npm package contains a regular expression denial of service (ReDoS) vulnerability in its request body processing logic. An attacker can craft large inputs that cause the regex engine to consume exponential CPU time, resulting in application performance degradation or service unavailability. No patch is currently available, and users are advised to switch to alternative packages.
Technical details
The sql-injection package processes request bodies using regular expressions that are vulnerable to catastrophic backtracking (ReDoS). An attacker can supply specially crafted large input strings that trigger exponential regex evaluation time, leading to denial of service. The vulnerability affects all versions of the package. No fix has been released; users should identify and migrate to alternative packages for SQL injection protection.
Affected products
- npm sql-injection all versions
Timeline
- 2020-09-03: disclosed