Skip to content

Security risk #110

Open
Open
@KennyGoi

Description

Affected files:
through2/node_modules/readable-stream/lib/_stream_readable.js
813: while (state.flowing && stream.read() !== null) {}

Risks:
An attacker could provide a very high loop iteration count, causing the loop to go on for prolonged periods of time, potentially causing the application to stop responding. Additionally, if the operation inside the loop is tied to some exhaustible functionality, it may cause bloat elsewhere; For example - if file writes occur inside the loop, then an attacker can cause that file to bloat by simply engaging this file writing capability a very high amount of times.

The application relied on a user-provided value to determine the number of iterations performed by a loop, without enforcing a limited range for this value.

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions