CVE-2021-41167 Unlimited requests in modern-async
The modern-async library fails to limit concurrency in forEachSeries and forEachLimit, potentially causing resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41167?
CVE-2021-41167 is a high-severity denial of service vulnerability in nicolas-van modern-async, published on 20 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.
Which versions are affected by CVE-2021-41167?
2 open source packages ship an affected version, including modern-async. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
modern-async npm | All versions | 1.0.4 |
modern-async npm | All versions | 1.0.4 |
Products include Modern-Async Project Modern-Async.
How do I fix CVE-2021-41167?
Upgrade modern-async to 1.0.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-41167 being exploited?
There is no known exploitation of CVE-2021-41167 in the wild and no public exploit code.
Sources
Also known as GHSA-3pcq-34w5-p4g2.