Packages / luxon / Security

HighVulnerabilityGHSA-3xq5-wjfh-ppjcCVE-2023-22467Published 9 Jan 2023

Luxon Inefficient Regular Expression Complexity vulnerability

Affected releases · luxon

  • 3.x3.0.0 – 3.2.0Fixed in 3.2.1
  • 2.x2.0.0 – 2.5.1Fixed in 2.5.2
  • 1.x1.0.0 – 1.28.0Fixed in 1.28.1

On 3.x, the newest line:

npm install luxon@3.2.1
3.x

  1. Affected

    3.0.0 – 3.2.0

    8 releases

  2. Fixed

    3.2.1 – 3.7.2

    13 releases, latest

2.x

  1. Affected

    2.0.0 – 2.5.1

    12 releases

  2. Fixed

    2.5.2

    1 release

1.x

  1. Affected

    1.0.0 – 1.28.0

    67 releases

  2. Fixed

    1.28.1

    1 release

150 stable releases of luxon, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for luxon. It is read in your browser and sent nowhere.

What happens

Impact

Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

This is the same bug as Moment's github.com/moment/moment/security/advisories/GH…

Workarounds

Limit the length of the input.

References

There is an excellent writeup of the same issue in Moment: #6015

Details

DateTime.fromRFC2822("(".repeat(500000)) takes a couple minutes to complete.