CVE-2021-39176
📋 TL;DR
CVE-2021-39176 is a memory leak vulnerability in the detect-character-encoding npm package versions 0.3.0 and earlier. The vulnerability allows attackers to cause denial of service through resource exhaustion by repeatedly triggering character encoding detection. This affects any application or service that uses the vulnerable package for character encoding detection.
💻 Affected Systems
- detect-character-encoding npm package
📦 What is this software?
Detect Character Encoding by Detect Character Encoding Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system resource exhaustion leading to denial of service, application crashes, and potential system instability affecting all services on the host.
Likely Case
Gradual memory consumption leading to degraded application performance, increased latency, and eventual service disruption requiring manual intervention.
If Mitigated
Minimal impact with proper monitoring and resource limits in place, though memory usage will still be higher than normal.
🎯 Exploit Status
Exploitation requires repeated calls to the vulnerable function, which could be automated. No authentication is needed if the vulnerable endpoint is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.3.1
Vendor Advisory: https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-5rwj-j5m3-3chj
Restart Required: Yes
Instructions:
1. Update package.json to specify 'detect-character-encoding': '^0.3.1'. 2. Run 'npm update detect-character-encoding'. 3. Restart your Node.js application. 4. Verify the update with 'npm list detect-character-encoding'.
🔧 Temporary Workarounds
Implement request rate limiting
allLimit the number of requests that can trigger character encoding detection to reduce memory consumption rate
Add memory usage monitoring and alerts
allMonitor application memory usage and implement alerts for abnormal consumption patterns
🧯 If You Can't Patch
- Implement application-level memory usage limits and automatic restart policies
- Deploy behind reverse proxies with request limiting and timeout configurations
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list detect-character-encoding' to see if version <= 0.3.0 is installedCheck Version:
npm list detect-character-encoding | grep detect-character-encodingVerify Fix Applied:
After updating, verify with 'npm list detect-character-encoding' that version 0.3.1 or higher is installed📡 Detection & Monitoring
Log Indicators:
- Rapid increase in memory usage patterns
- Application restarts due to memory exhaustion
- High frequency of character encoding detection calls
Network Indicators:
- Unusually high request rates to endpoints using character encoding detection
- Pattern of repeated similar requests
SIEM Query:
source="application_logs" AND ("out of memory" OR "memory limit exceeded" OR "heap out of memory") AND process="node"🔗 References
- https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588
- https://github.com/sonicdoe/detect-character-encoding/pull/6
- https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1
- https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-5rwj-j5m3-3chj
- https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588
- https://github.com/sonicdoe/detect-character-encoding/pull/6
- https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1
- https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-5rwj-j5m3-3chj
