CVE-2026-24001
📋 TL;DR
This vulnerability in jsdiff library allows denial-of-service attacks through infinite loops and resource exhaustion when parsing patches containing specific line break characters. Applications using jsdiff's parsePatch or applyPatch methods with user-controlled input are affected. The vulnerability can crash processes by consuming unlimited memory.
💻 Affected Systems
- jsdiff JavaScript library
📦 What is this software?
Jsdiff by Kpdecker
Jsdiff by Kpdecker
Jsdiff by Kpdecker
Jsdiff by Kpdecker
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage through process crashes, potentially affecting multiple services if jsdiff is used in critical paths.
Likely Case
Denial-of-service causing application crashes and downtime when malicious patches are processed.
If Mitigated
Limited impact with proper input validation and patching, though some performance degradation may occur.
🎯 Exploit Status
Exploitation requires only small malicious patches, making it easy to weaponize. No authentication needed if user input reaches vulnerable methods.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.3, 5.2.2, 4.0.4, or 3.5.1
Vendor Advisory: https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx
Restart Required: Yes
Instructions:
1. Update jsdiff to version 8.0.3, 5.2.2, 4.0.4, or 3.5.1 using npm update jsdiff. 2. Restart all applications using jsdiff. 3. Verify no regressions in patch parsing functionality.
🔧 Temporary Workarounds
Input validation filter
allFilter out \r, \u2028, and \u2029 characters from patch inputs before processing
// JavaScript implementation:
function sanitizePatch(patch) {
return patch.replace(/[\r\u2028\u2029]/g, '');
}
// Use: parsePatch(sanitizePatch(userInput));
🧯 If You Can't Patch
- Implement strict input validation to reject patches containing \r, \u2028, or \u2029 characters
- Isolate jsdiff processing in separate containers with memory limits to contain crashes
🔍 How to Verify
Check if Vulnerable:
Check package.json for jsdiff version. If version is below 8.0.3, 5.2.2, 4.0.4, or 3.5.1, you are vulnerable.Check Version:
npm list jsdiff | grep jsdiffVerify Fix Applied:
After updating, test parsePatch with patches containing \r, \u2028, or \u2029 characters - should process normally without infinite loops.📡 Detection & Monitoring
Log Indicators:
- Process crashes with out-of-memory errors
- Unusually high memory consumption in jsdiff processes
- Long-running parsePatch operations
Network Indicators:
- Multiple patch submissions from single source
- Small patch payloads causing service degradation
SIEM Query:
Process:memory_usage > 90% AND Process:name contains 'node' AND Event:description contains 'jsdiff' OR 'parsePatch'