CVE-2017-16098 Regular Expression Denial of Service in charset
Attackers can cause denial of service in the charset Node.js module via regular expression complexity, though impact is limited by default header size constraints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16098?
CVE-2017-16098 is a high-severity denial of service vulnerability in HackerOne charset node module, published on 7 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.
Weakness: CWE-400
Which versions are affected by CVE-2017-16098?
2 open source packages ship an affected version, including charset. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
charset npm | All versions | 1.0.1 |
charset npm | All versions | 1.0.1 |
Products include Charset Project Charset.
How do I fix CVE-2017-16098?
Upgrade charset to 1.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-16098 being exploited?
There is no known exploitation of CVE-2017-16098 in the wild and no public exploit code.
Sources
Also known as GHSA-9cp3-fh5x-xfcj.