Find, fix and prevent vulnerabilities in your code.

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) in the firstPhasePreProcess method, where the **/.. transform clones a globParts entry and pushes the clone back onto the same array inside a do...while (didSomething) fixpoint loop. An attacker can exhaust CPU and memory by supplying a glob pattern whose **/.. sequences regenerate entries during preprocessing, which secondPhasePreProcess then compares in an O(n^2) pairwise partsMatch pass over the expanded set. Exploitation requires the pattern to be parsed with optimizationLevel set to 2 or higher.

Remediation

Upgrade minimatch to version 11.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars(), which decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. An attacker can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.

Remediation

There is no fixed version for uri-js.

References

• GitHub Issue
• Vulnerable Code

Overview

Affected versions of this package are vulnerable to Symlink Attack via the dir parameter. An attacker can cause files or directories to be written to arbitrary locations by supplying a crafted symbolic link that resolves outside the intended temporary directory.

PoC

const tmp = require('tmp');

const tmpobj = tmp.fileSync({ 'dir': 'evil-dir'});
console.log('File: ', tmpobj.name);

try {
    tmp.fileSync({ 'dir': 'mydir1'});
} catch (err) {
    console.log('test 1:', err.message)
}

try {
    tmp.fileSync({ 'dir': '/foo'});
} catch (err) {
    console.log('test 2:', err.message)
}

try {
    const fs = require('node:fs');
    const resolved = fs.realpathSync('/tmp/evil-dir');
    tmp.fileSync({ 'dir': resolved});
} catch (err) {
    console.log('test 3:', err.message)
}

Remediation

Upgrade tmp to version 0.2.4 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres function due to improperly deleting keys from the reqs object after execution of callbacks. This behavior causes the keys to remain in the reqs object, which leads to resource exhaustion.

Exploiting this vulnerability results in crashing the node process or in the application crash.

Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.

To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.

PoC

const inflight = require('inflight');

function testInflight() {
  let i = 0;
  function scheduleNext() {
    let key = `key-${i++}`;
    const callback = () => {
    };
    for (let j = 0; j < 1000000; j++) {
      inflight(key, callback);
    }

    setImmediate(scheduleNext);
  }


  if (i % 100 === 0) {
    console.log(process.memoryUsage());
  }

  scheduleNext();
}

testInflight();

Remediation

There is no fixed version for inflight.

References

• GitHub Issue
• GitHub PR

Overview

i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data (MAID) via the deepExtend function in src/utils.js, which uses the in operator to check for property existence on the target object. Because the in operator traverses the prototype chain, an attacker who can supply a malicious resource bundle containing a property named hasOwnProperty can overwrite Object.prototype.hasOwnProperty, causing process-wide corruption of that built-in and crashing any subsequent code that relies on it.

Note: This is only exploitable when deepExtend is invoked with deep merging enabled, such as through addResourceBundle with the deep parameter set to true.

PoC

import i18next from 'i18next';

await i18next.init({ lng: 'en', resources: { en: { translation: {} } } });

const payload = { hasOwnProperty: { call: 'corrupted' } };
i18next.addResourceBundle('en', 'translation', payload, /* deep */ true, /* overwrite */ true);

// Process-wide corruption:
Object.prototype.hasOwnProperty.call({}, 'test'); // TypeError: ... is not a function

Note: The PoC uses i18next initialised with a default English translation resource and demonstrates process-wide corruption by overwriting Object.prototype.hasOwnProperty via addResourceBundle with deep and overwrite flags set to true.

Remediation

Upgrade i18next to version 26.3.4 or higher.

References

• GitHub Advisory
• github.com
• GitHub Commit

Overview

uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Affected versions of this package are vulnerable to Uncaught Exception in the parse() function of src/schemes/mailto.ts, whose to branch calls hfield[1].split(",") directly, while the subject, body, and default branches all route through unescapeComponent(), which short-circuits on a missing value. An attacker can crash the process by supplying a mailto URI whose query carries a bare to token with no =value, such as mailto:?to, so splitting on = yields a one element array and the undefined second element is dereferenced. This requires the application to pass an attacker-influenced string to URI.parse(), URI.resolve(), URI.normalize(), or URI.equal(), none of which wrap the scheme handler in a try/catch, and whether the throw terminates the process or only fails the one request depends on the host's own error handling.

Remediation

There is no fixed version for uri-js.

References

• GitHub Issue