ReDoS Vulnerability in aws-lambda-multipart-parser by Anton Myshenin

CVE-2018-7560

What is CVE-2018-7560?

The aws-lambda-multipart-parser, a package developed by Anton Myshenin, is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability found in its index.js file. This flaw arises from the way crafted multipart/form-data boundary strings are processed, allowing an attacker to exploit this vulnerability by sending specially designed input. When the vulnerable version, prior to 0.1.2, is employed, it potentially opens up applications to denial of service attacks, causing performance degradation or service interruption.

References