CVE-2021-33623 Uncontrolled Resource Consumption in trim-newlines
An attacker can cause a denial of service in applications using the trim-newlines library via a regular expression denial-of-service attack.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-33623?
CVE-2021-33623 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 28 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Weakness: CWE-400
Which versions are affected by CVE-2021-33623?
4 open source packages ship an affected version, including trim-newlines. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
trim-newlines npm | All versions | 3.0.1 |
trim-newlines npm | All versions | 3.0.1 |
trim-newlines npm | From 4.0.0 | 4.0.1 |
trim-newlines npm | From 4.0.0 | 4.0.1 |
Products include Debian Debian Linux, Netapp E-Series Performance Analyzer, Trim-Newlines Project Trim-Newlines.
How do I fix CVE-2021-33623?
Upgrade trim-newlines to a fixed version for your release line: 3.0.1 or 4.0.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-33623 being exploited?
There is no known exploitation of CVE-2021-33623 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLSA-2026-1772496678, CLSA-2026-1773015268, CLSA-2026-1777163883, DEBIAN-CVE-2021-33623, DLA-3247-1, GHSA-7p7h-4mm5-852v and 3 more.