CVE-2022-36034 Possible Regular Expression Denial of Service (ReDoS) used on uncontrolled data in nitrado.js
Attackers can cause denial of service in nitrado.js by supplying crafted input that triggers excessive regular expression backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36034?
CVE-2022-36034 is a high-severity denial of service vulnerability in cainthebest nitrado.js, published on 29 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in all versions above `0.2.5`. There are currently no known workarounds.
Which versions are affected by CVE-2022-36034?
2 open source packages ship an affected version, including nitrado.js. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nitrado.js npm | All versions | 0.2.5 |
nitrado.js npm | All versions | 0.2.5 |
Products include Nitrado.js Project Nitrado.js.
How do I fix CVE-2022-36034?
Upgrade nitrado.js to 0.2.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-36034 being exploited?
There is no known exploitation of CVE-2022-36034 in the wild and no public exploit code.
Sources
Also known as GHSA-vqc4-v8hc-h2jg.