REDHAT-BUG-2453162: Medium severity OpenJS Foundation Node.js vulnerability
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2453162?
The severity of REDHAT-BUG-2453162 is categorized as medium with a score of 4.
What vulnerabilities does REDHAT-BUG-2453162 affect?
REDHAT-BUG-2453162 affects OpenJS Foundation Node.js due to a flaw in V8's string hashing mechanism.
How does REDHAT-BUG-2453162 impact Node.js performance?
REDHAT-BUG-2453162 can significantly degrade Node.js performance by allowing attackers to create hash collisions in V8's internal string table.
What is the nature of the flaw in REDHAT-BUG-2453162?
The flaw in REDHAT-BUG-2453162 causes integer-like strings to be hashed to their numeric value, leading to predictable hash collisions.
What can an attacker do with the vulnerability described in REDHAT-BUG-2453162?
An attacker can exploit REDHAT-BUG-2453162 to degrade the performance of Node.js applications by crafting requests that trigger hash collisions.