anchorme Regex DoS via IPv6 Host Extraction

Executive Summary

This vulnerability is a regular expression denial of service (ReDoS) issue in the anchorme library version 3.0.8. It occurs due to catastrophic backtracking in the IPv6 host extraction regex. Attackers can exploit this by sending input strings with repeated patterns, causing the regex engine to perform excessive backtracking. This blocks the Node.js event loop, preventing the server from processing other requests and effectively denying service to legitimate users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for excessive CPU usage or event loop delays in Node.js applications using the anchorme library. Check for repeated patterns in input strings that may trigger catastrophic backtracking in the IPv6 host extraction regex.

Useful 0 Not Useful 0

Impact Analysis

If you are using the affected version of anchorme, this vulnerability can cause your application to become unresponsive or crash when processing malicious input. This leads to downtime, degraded performance, and potential loss of service for users. It may also expose your system to further attacks if the event loop remains blocked.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical denial-of-service issue in a software library. However, if exploited, it could lead to service unavailability, potentially violating availability requirements in GDPR Article 32 or HIPAA Security Rule Section 164.308(a)(7).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the anchorme library to version 3.0.9 or later, which patches the regex vulnerability. If updating is not possible, consider disabling the IPv6 host extraction feature or implementing input validation to prevent malicious patterns from reaching the regex engine.

Useful 0 Not Useful 0