CVE-2021-27405 Regular expression Denial of Service in @progfay/scrapbox-parser
Attackers can cause a denial of service in applications using the scrapbox-parser library by submitting specially crafted input that triggers excessive CPU usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-27405?
CVE-2021-27405 is a high-severity denial of service vulnerability in n/a, published on 19 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js.
Weakness: CWE-400
Which versions are affected by CVE-2021-27405?
4 open source packages ship an affected version, including @progfay/scrapbox-parser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@progfay/scrapbox-parser npm | All versions | 6.0.3 |
@progfay/scrapbox-parser npm | All versions | 6.0.3 |
@progfay/scrapbox-parser npm | From 7.0.0 | 7.0.2 |
@progfay/scrapbox-parser npm | From 7.0.0 | 7.0.2 |
Products include Scrapbox-Parser Project Scrapbox-Parser.
How do I fix CVE-2021-27405?
Upgrade @progfay/scrapbox-parser to a fixed version for your release line: 6.0.3 or 7.0.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-27405 being exploited?
There is no known exploitation of CVE-2021-27405 in the wild and no public exploit code.
Sources
Also known as GHSA-9fhw-r42p-5c7r.