http-cache-semantics vulnerable to Regular Expression Denial of Service

Description

http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Recommendation

Update the http-cache-semantics package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.1.1
• Patched version(s): 4.1.1

References

• GHSA-rc47-6667-2j5j
• security.snyk.io
• security.netapp.com
• CVE-2022-25881
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• steal vulnerable to Regular Expression Denial of Service via input variable - CVE-2022-37260
• steal vulnerable to Regular Expression Denial of Service via source and sourceWithComments - CVE-2022-37262
• angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844
• es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens` - CVE-2024-27088

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

http-cache-semantics