Forge: ReDoS in forge.http response header and cookie trimming

forge.http trims response header and Set-Cookie values with the regular expression /\s*$/, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a forge.http client for minutes with one large response header. Fixed in node-forge 1.4.3.

Details

_trimString() in lib/http.js removes trailing whitespace with str.replace(/\s*$/, ''). On a string of n whitespace characters followed by a non-whitespace character, the regular expression engine tries a match at each of the n positions and scans the rest of the run each time, so the work is O(n^2). forge.http calls _trimString() on every response header value read by response.readHeader(), and again on cookie names and values in response.getCookies(). There is no limit on header size.

With Node.js 24, an 80 KB header value takes about 4 seconds to parse, and 1 MB about 10 minutes, during which the event loop (or browser tab) is blocked.

forge.http is not loaded by require('node-forge'). It is part of the forge.all bundle and needs a socket pool provided by the application (historically Flash sockets via forge.xhr), so few applications use it.

The fix trims trailing whitespace with a loop, as lib/pem.js has done since 1.4.1. The trimmed result is unchanged.

Patches

Fixed in node-forge 1.4.3.

Workarounds

Limit the size of HTTP response headers before passing them to forge.http, for example in the socket pool's data handler.

Resources

• Related: GHSA-7wch-p9px-956x (ReDoS in PEM decoding, fixed in 1.4.1): https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x

Severity

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, Moderate) CVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2) CVSS 4.0 has no counterpart to 3.1's AC:H beyond AT:P and scores this higher; the severity rating follows CVSS 3.1.

Credits

Reported by @manus-pi.

Proof of concept

var response = forge.http.createResponse();
var ws = new Array(40001).join('\t ');
response.readHeader(forge.util.createBuffer(
  'HTTP/1.1 200 OK\r\nX-A: a' + ws + 'X\r\n\r\n'));
// <= 1.4.2: about 4 seconds (quadratic in the whitespace length)
// 1.4.3: about 1 ms

Regression tests are in tests/security/ghsa-6cv4-p8m7-4r25.js.

Impact

Applications that use forge.http to talk to servers they don't control are affected. The server, or an on-path attacker, can send a response header that blocks the client's event loop for minutes, denying service to everything else in the process. There is no confidentiality or integrity impact.