GHSA-f52g-6jhx-586p Denial of Service in handlebars
Attackers can cause a denial of service by forcing the handlebars parser into an endless loop with specially crafted templates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-f52g-6jhx-586p?
GHSA-f52g-6jhx-586p is a denial of service vulnerability in handlebars, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of handlebars are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.
Recommendation
Upgrade to version 4.4.5 or later.
Which versions are affected by GHSA-f52g-6jhx-586p?
2 open source packages ship an affected version, including handlebars.
| Package | Affected | Fixed in |
|---|---|---|
handlebars npm | From 4.0.0 | 4.4.5 |
handlebars npm | From 4.0.0 | 4.4.5 |
How do I fix GHSA-f52g-6jhx-586p?
Upgrade handlebars to 4.4.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-f52g-6jhx-586p being exploited?
There is no known exploitation of GHSA-f52g-6jhx-586p in the wild and no public exploit code.