Skip to content

fix: disable regexp backtracking#160

Merged
satazor merged 1 commit intomasterfrom
bugfix/regexp-backtrack
Nov 6, 2024
Merged

fix: disable regexp backtracking#160
satazor merged 1 commit intomasterfrom
bugfix/regexp-backtrack

Conversation

@satazor
Copy link
Contributor

@satazor satazor commented Nov 6, 2024

With a very large and well crafted string, the escaping made by cross-spawn hangs forever.

const { argument } = require('cross-spawn/lib/util/escape');
var str = "";
for (var i = 0; i < 1000000; i++) {
  str += "\\";
}
str += "◎";

console.log("start")
argument(str)
console.log("end")

This PR disables regexp back tracking so that it doesn't suffer from this. https://javascript.info/regexp-catastrophic-backtracking for more details.

gurus00 pushed a commit to gurus00/node-cross-spawn that referenced this pull request Feb 11, 2025
highorbit25 added a commit to highorbit25/concert-vuln-app that referenced this pull request Feb 5, 2026
Resolves: #28

Vulnerability Details:
- CVE: CVE-2024-21538
- Severity: HIGH
- CVSS Score: 7.5
- Package: cross-spawn (transitive dependency)
- Vulnerable Version: 7.0.3
- Fixed Version: 7.0.5
- CWE: CWE-1333 (Inefficient Regular Expression Complexity)

Remediation:
Added npm overrides to force cross-spawn to version 7.0.5, which contains
the security fix for this HIGH severity ReDoS vulnerability. The cross-spawn
package is a transitive dependency of Next.js and other build tools.

This fix prevents Regular Expression Denial of Service (ReDoS) attacks that
could cause CPU exhaustion and application crashes through crafted input strings.

Automated fix generated by IBM Bob based on CVE research from:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21538
- Snyk Advisory: https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
- GitHub PR: moxystudio/node-cross-spawn#160
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants