CVE-2022-21144 Denial of Service (DoS)
Attackers can crash the application by passing non-buffer arguments with invalid toString methods to the parseXml function in libxmljs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21144?
CVE-2022-21144 is a high-severity denial of service vulnerability in libxmljs, published on 1 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.
Weakness: CWE-20
Which versions are affected by CVE-2022-21144?
2 open source packages ship an affected version, including libxmljs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libxmljs npm | All versions | 0.19.8 |
libxmljs npm | All versions | 0.19.8 |
Products include Libxmljs Project Libxmljs.
How do I fix CVE-2022-21144?
Upgrade libxmljs to 0.19.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-21144 being exploited?
There is no known exploitation of CVE-2022-21144 in the wild and no public exploit code.
Other vulnerabilities in libxmljs
Sources
Also known as GHSA-773h-w45w-f2f9, SNYK-JS-LIBXMLJS-2348756.