Luxon Inefficient Regular Expression Complexity vulnerability

Description

Luxon’s DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

This is the same bug as Moment’s https://github.

Recommendation

Update the luxon package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.0.0, < 1.28.1

  >= 3.0.0, < 3.2.1

  >= 2.0.0, < 2.5.2**

• Patched version(s): **1.28.1

  3.2.1

  2.5.2**

References

• GHSA-3xq5-wjfh-ppjc
• lists.fedoraproject.org
• CVE-2023-22467
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• skeemas Inefficient Regular Expression Complexity vulnerability - CVE-2018-25074
• Vercel ms Inefficient Regular Expression Complexity vulnerability - CVE-2017-20162
• debug Inefficient Regular Expression Complexity vulnerability - CVE-2017-20165
• is-url Inefficient Regular Expression Complexity vulnerability - CVE-2018-25079

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

luxon