Regular Expression Denial of Service in string package

An attacker can exploit this vulnerability by injecting malicious input designed to trigger a regular expression denial of service within the string.js library. This can lead to a complete crash of the Node.js application utilizing the library, effectively denying service to legitimate users. The impact is particularly severe in production environments where the application is critical and downtime is unacceptable. The vulnerability’s reliance on regular expression processing means that even relatively small payloads can trigger the DoS condition, making it difficult to detect and mitigate without careful input validation or code modification. Similar regex-based DoS vulnerabilities have historically resulted in significant service outages.

Applications built on Node.js that utilize the string.js library, particularly those that process user-supplied data without proper sanitization, are at risk. Web applications, APIs, and backend services relying on string.js are all potential targets. Developers using older versions of string.js without regular security updates are also at increased risk.

• nodejs / server:

  ps aux | grep string.js | grep 'underscore|unescapeHTML'

• nodejs / server:

  journalctl -u your-node-app | grep -i "regular expression" -i "underscore" -i "unescapeHTML"

• generic web: Inspect application logs for errors related to regular expression processing or unexpected resource consumption when using string.js.

1. 2017-11-15Discovery

   discovery

2. 2018-07-24Disclosure

   disclosure

3. 2018-07-24PoC

   poc

1. Gepubliceerd2018-07-24
2. Gewijzigd2023-11-08
3. EPSS bijgewerkt2026-04-02

Due to the lack of an official patch, mitigation strategies focus on preventing the vulnerable code paths from being executed. The primary recommendation is to avoid passing user-supplied input directly to the underscore and unescapeHTML methods within string.js. If these methods are essential, consider implementing strict input validation to sanitize user input before processing. A user-provided patch is available in Pull Request #217 on the string.js GitHub repository; however, it is crucial to thoroughly test this patch in a non-production environment before deploying it to production. After applying the patch or implementing input validation, confirm functionality by testing with various input strings, including those known to trigger the vulnerability.