luxon.js inefficient regular expression complexity vulnerability
CVE-2023-22467
What is CVE-2023-22467?
The Luxon library, utilized for date and time manipulation in JavaScript, exhibits a performance degradation issue affecting versions prior to 1.38.1 in the 1.x branch, prior to 2.5.2 in the 2.x branch, and version 3.2.1 in the 3.x branch. Specifically, the DateTime.fromRFC2822() function demonstrates quadratic complexity (O(N^2)) for certain inputs, notably input strings exceeding 10,000 characters. This vulnerability allows attackers to launch (Re)DoS (Denial of Service) attacks through carefully crafted untrusted data. While the recent updates address this flaw, developers are advised to implement input length restrictions as an additional preventive measure.
Affected Version(s)
luxon >= 1.0.0, < 1.38.1 < 1.0.0, 1.38.1
luxon >= 2.0.0, < 2.5.2 < 2.0.0, 2.5.2
luxon >= 3.0.0, < 3.2.1 < 3.0.0, 3.2.1