CVE-2021-39157
📋 TL;DR
This vulnerability in detect-character-encoding library causes Node.js processes to crash when processing data that doesn't match any known character encoding. It affects all applications using detect-character-encoding v0.6.0 or earlier. The crash can lead to denial of service and potential data loss.
💻 Affected Systems
- detect-character-encoding
📦 What is this software?
Detect Character Encoding by Detect Character Encoding Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through repeated crashes, leading to extended downtime and potential data corruption in applications relying on this library.
Likely Case
Intermittent application crashes when processing malformed or unusual character data, causing service interruptions and degraded reliability.
If Mitigated
Minimal impact with proper monitoring and rapid restart capabilities, though still causing brief service interruptions.
🎯 Exploit Status
Exploitation requires sending data that triggers the encoding detection failure, which is straightforward to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.7.0
Vendor Advisory: https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-jqfh-8hw5-fqjr
Restart Required: Yes
Instructions:
1. Update package.json to require detect-character-encoding v0.7.0 or later. 2. Run 'npm update detect-character-encoding'. 3. Restart all Node.js applications using this library.
🔧 Temporary Workarounds
No workarounds available
allThe vulnerability has no known workarounds according to the advisory
🧯 If You Can't Patch
- Implement rate limiting on endpoints that process character encoding to reduce crash frequency
- Deploy application monitoring with automatic restart capabilities to minimize downtime from crashes
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for detect-character-encoding version <=0.6.0Check Version:
npm list detect-character-encodingVerify Fix Applied:
Verify detect-character-encoding version is >=0.7.0 in package.json and node_modules📡 Detection & Monitoring
Log Indicators:
- Node.js process crashes with segmentation faults
- Application restarts without clear cause
- Error logs showing encoding detection failures
Network Indicators:
- Unusual patterns of data sent to encoding processing endpoints
- Repeated requests to endpoints that trigger encoding detection
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "process crashed" OR "encoding detection failed")🔗 References
- https://github.com/sonicdoe/detect-character-encoding/commit/992a11007fff6cfd40b952150ab8d30410c4a20a
- https://github.com/sonicdoe/detect-character-encoding/issues/15
- https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-jqfh-8hw5-fqjr
- https://github.com/sonicdoe/detect-character-encoding/commit/992a11007fff6cfd40b952150ab8d30410c4a20a
- https://github.com/sonicdoe/detect-character-encoding/issues/15
- https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-jqfh-8hw5-fqjr
