Regular Expression Denial of Service (ReDoS)

[larrycameron80]

Regular Expression Denial of Service (ReDoS)
Vulnerable module: fresh
Introduced through: express@4.14.1 and serve-favicon@2.3.2
Detailed paths
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › express@4.14.1 › fresh@0.3.0
Remediation: Upgrade to express@4.15.5.
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › serve-favicon@2.3.2 › fresh@0.3.0
Remediation: Upgrade to serve-favicon@2.4.5.
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › express@4.14.1 › send@0.14.2 › fresh@0.3.0
Remediation: Upgrade to express@4.15.5.
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › express@4.14.1 › serve-static@1.11.2 › send@0.14.2 › fresh@0.3.0
Remediation: Upgrade to express@4.15.5.
Overview
fresh is HTTP response freshness testing.

Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks. A Regular Expression (/ *, */) was used for parsing HTTP headers and take about 2 seconds matching time for 50k characters.