CVE-2024-41655 TF2 Item Format Regular Expression Denial of Service vulnerability
An attacker can cause a denial of service in applications using this library by submitting crafted input that triggers excessive regex processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41655?
CVE-2024-41655 is a high-severity denial of service vulnerability in danocmx node-tf2-item-format, published on 23 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.
Which versions are affected by CVE-2024-41655?
2 open source packages ship an affected version, including tf2-item-format.
| Package | Affected | Fixed in |
|---|---|---|
tf2-item-format npm | From 4.2.6 | 5.9.14 |
tf2-item-format npm | From 4.2.6 | 5.9.14 |
How do I fix CVE-2024-41655?
Upgrade tf2-item-format to 5.9.14 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-41655 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41655 exists.
Sources
Also known as GHSA-8h55-q5qq-p685.