CVE-2018-7560 AWS Lambda parser is vulnerable to Regular Expression Denial of Service
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm aws-lambda-multipart-parser(npm) | < 0.1.2 | 0.1.2 |
| aws-lambda-multipart-parser project aws-lambda-multipart-parser | <= 0.1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com patch third-party-advisory
- github.com