CVE-2023-22467: luxon.js inefficient regular expression complexity vulnerability
# Impact Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This is the same bug as Moment's https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g # Workarounds Limit the length of the input. # References There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973 # Details `DateTime.fromRFC2822("(".repeat(500000))` takes a couple minutes to complete.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-22467?
CVE-2023-22467 is a vulnerability in the luxon package that leads to a regular expression denial of service.
Which software is affected by CVE-2023-22467?
The vulnerability affects Luxon versions 1.x prior to 1.38.1, 2.x prior to 2.5.2, and 3.x prior to 3.2.1.
What is Luxon?
Luxon is a JavaScript library used for working with dates and times.
What is the severity of CVE-2023-22467?
CVE-2023-22467 has a severity rating of high (7) based on the Common Vulnerability Scoring System (CVSS) v3.0.
How can I fix CVE-2023-22467?
To fix CVE-2023-22467, upgrade Luxon to version 1.38.1 for 1.x branch, 2.5.2 for 2.x branch, or 3.2.1 for 3.x branch.