CVE-2017-16115: High severity Timespan Project Timespan Node.js vulnerability
Affected versions of timespan are vulnerable to a regular expression denial of service when parsing dates.
The amplification for this vulnerability is significant, with 50,000 characters resulting in the event loop being blocked for around 10 seconds.
Recommendation
No direct patch is available for this vulnerability.
Currently, the best available solution is to use a functionally equivalent alternative package.
It is also sufficient to ensure that user input is not being passed into timespan, or that the maximum length of such user input is drastically reduced. Limiting the input length to 150 characters should be sufficient in most cases.
Other sources
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Replace the vulnerable timespan module with a functionally equivalent alternative package, or prevent untrusted user input from being passed to timespan; if input must be accepted, limit it to a maximum of 150 characters.