high7.5
CVE-2022-24434
Crash in HeaderParser in dicer
Impact
This affects all versions of the package `dicer`. A malicious attacker can send a modified form to the server and crash the Node.js service. A complete denial of service can be achieved by sending the malicious form in a loop.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | dicer | <= 0.3.1 | none recorded |
| maven | org.webjars.npm:dicer | <= 0.3.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dicer Project | Dicer | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mscdex/busboy/issues/250
- https://github.com/mscdex/dicer/pull/22
- https://github.com/mscdex/dicer/pull/22/commits/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2838865
- https://snyk.io/vuln/SNYK-JS-DICER-2311764
- https://github.com/advisories/GHSA-wm7h-9275-46v2
- https://nvd.nist.gov/vuln/detail/CVE-2022-24434
- https://github.com/mscdex/dicer/commit/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac