CVE-2023-22467: luxon.js inefficient regular expression complexity vulnerability
Impact Luxon's DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.
This is the same bug as Moment's https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g
Workarounds Limit the length of the input.
References There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973
Details DateTime.fromRFC2822("(".repeat(500000)) takes a couple minutes to complete.
Other sources
A flaw was found in the luxon package, resulting in a regular expression denial of service. This issue could allow an attacker to craft and supply inputs above 10k characters, causing a denial of service.
Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-22467?
CVE-2023-22467 is a vulnerability in the luxon package that leads to a regular expression denial of service.
Which software is affected by CVE-2023-22467?
The vulnerability affects Luxon versions 1.x prior to 1.38.1, 2.x prior to 2.5.2, and 3.x prior to 3.2.1.
What is Luxon?
Luxon is a JavaScript library used for working with dates and times.
What is the severity of CVE-2023-22467?
CVE-2023-22467 has a severity rating of high (7) based on the Common Vulnerability Scoring System (CVSS) v3.0.
How can I fix CVE-2023-22467?
To fix CVE-2023-22467, upgrade Luxon to version 1.38.1 for 1.x branch, 2.5.2 for 2.x branch, or 3.2.1 for 3.x branch.