Executive brief
url-relative is a JavaScript library that calculates RFC 1808-compliant relative URLs. When provided with identical "from" and "to" URL parameters, the library enters an infinite loop and hangs, causing any application using it to become unresponsive. This can allow an attacker to trigger a denial of service by passing matching URLs to the vulnerable function.
Technical details
The vulnerability is an infinite loop (CWE-400) in url-relative's relative URL calculation logic. When the "from" and "to" parameters are identical, the function fails to exit and hangs indefinitely, consuming resources. The attack is network-accessible and requires no authentication or user interaction, but requires high attack complexity as the attacker must control the input parameters to the vulnerable function. An attacker can trigger application unresponsiveness and denial of service. No fix is currently available; the project recommends using an alternative module until patched.
Affected products
- npm url-relative all versions up to and including 1.0.0
Timeline
- 2019-06-05: disclosed