CVE-2022-25881: High severity Http-cache-semantics Project Http-cache-semantics Node.js vulnerability
A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.
Other sources
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server when that server reads the cache policy from the request using this library.
— Microsoft
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 18-9020020230327152102.rhel9 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 1:16.19.1-1.el9_2 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 1:16.20.2-1.el9_0 - Upgrade
Upgrade
redhat/rh-nodejs14to a version that resolves this vulnerability.Fixed in 0:3.6-2.el7 - Upgrade
Upgrade
redhat/rh-nodejs14-nodejsto a version that resolves this vulnerability.Fixed in 0:14.21.3-2.el7 - Upgrade
Upgrade
redhat/http-cache-semanticsto a version that resolves this vulnerability.Fixed in 4.1.1 - Upgrade
Upgrade
http-cache-semanticsto a version that resolves this vulnerability.Fixed in 4.1.1 - Compensating control
Mitigate the Regular Expression Denial of Service by filtering or blocking malicious request header values before the server processes cache policy headers with the http-cache-semantics library.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-25881?
CVE-2022-25881 is a vulnerability in the http-cache-semantics module of Node.js, which can be exploited by a remote attacker to cause a denial of service.
How does CVE-2022-25881 affect the affected software?
CVE-2022-25881 affects the http-cache-semantics module version 4.1.1 and certain versions of Node.js, potentially leading to a denial of service condition.
What is the severity of CVE-2022-25881?
The severity of CVE-2022-25881 is high, with a CVSS score of 7.5.
How can CVE-2022-25881 be fixed?
To fix CVE-2022-25881, update the http-cache-semantics module to version 4.1.1 or apply the recommended patches for the affected versions of Node.js.
Where can I find more information about CVE-2022-25881?
You can find more information about CVE-2022-25881 at the following references: [Reference 1](https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783), [Reference 2](https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83), and [Reference 3](https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332).