The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Weakness
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Normalize-url | Normalize-url_project | 4.3.0 (including) | 4.5.1 (excluding) |
| Normalize-url | Normalize-url_project | 5.0.0 (including) | 5.3.1 (excluding) |
| Normalize-url | Normalize-url_project | 6.0.0 (including) | 6.0.0 (including) |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:16-8050020211206113934.c5368500 | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:14-8050020211213115342.c5368500 | * |
| Red Hat Enterprise Linux 8.4 Extended Update Support | RedHat | nodejs:14-8040020211213111158.522a0ee4 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs-nodemon-0:2.0.19-1.el9_0 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs12-nodejs-0:12.22.2-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs12-nodejs-nodemon-0:2.0.3-2.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-0:14.17.2-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-nodemon-0:2.0.3-2.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs12-nodejs-0:12.22.2-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs12-nodejs-nodemon-0:2.0.3-2.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs14-nodejs-0:14.17.2-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs14-nodejs-nodemon-0:2.0.3-2.el7 | * |
| Red Hat Virtualization Engine 4.4 | RedHat | ovirt-engine-ui-extensions-0:1.3.3-1.el8ev | * |
| Red Hat Virtualization Engine 4.4 | RedHat | ovirt-web-ui-0:1.8.1-2.el8ev | * |
| Node-got | Ubuntu | bionic | * |
| Node-got | Ubuntu | focal | * |
| Node-got | Ubuntu | groovy | * |
| Node-got | Ubuntu | hirsute | * |
| Node-got | Ubuntu | impish | * |
| Node-got | Ubuntu | kinetic | * |
| Node-got | Ubuntu | lunar | * |
| Node-got | Ubuntu | mantic | * |
| Node-got | Ubuntu | oracular | * |
| Node-got | Ubuntu | plucky | * |
| Node-got | Ubuntu | trusty | * |
| Node-got | Ubuntu | xenial | * |
| Node-yarnpkg | Ubuntu | focal | * |
| Node-yarnpkg | Ubuntu | groovy | * |
| Node-yarnpkg | Ubuntu | hirsute | * |
| Node-yarnpkg | Ubuntu | impish | * |
| Node-yarnpkg | Ubuntu | kinetic | * |
| Node-yarnpkg | Ubuntu | lunar | * |
| Node-yarnpkg | Ubuntu | mantic | * |
| Node-yarnpkg | Ubuntu | oracular | * |
| Node-yarnpkg | Ubuntu | plucky | * |
| Node-yarnpkg | Ubuntu | trusty | * |
| Node-yarnpkg | Ubuntu | xenial | * |
Extended Description
Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.