CVE-2022-25881: High severity Http-cache-semantics Project Http-cache-semantics Node.js vulnerability
A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.
Other sources
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server when that server reads the cache policy from the request using this library.
— Microsoft
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-25881?
CVE-2022-25881 is a vulnerability in the http-cache-semantics module of Node.js, which can be exploited by a remote attacker to cause a denial of service.
How does CVE-2022-25881 affect the affected software?
CVE-2022-25881 affects the http-cache-semantics module version 4.1.1 and certain versions of Node.js, potentially leading to a denial of service condition.
What is the severity of CVE-2022-25881?
The severity of CVE-2022-25881 is high, with a CVSS score of 7.5.
How can CVE-2022-25881 be fixed?
To fix CVE-2022-25881, update the http-cache-semantics module to version 4.1.1 or apply the recommended patches for the affected versions of Node.js.
Where can I find more information about CVE-2022-25881?
You can find more information about CVE-2022-25881 at the following references: [Reference 1](https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783), [Reference 2](https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83), and [Reference 3](https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332).