Vulnerability · Published May 13, 2024 · Assigned by Checkmarx
CVE-2024-4067Regular Expression Denial of Service in micromatch
Medium 5.3
In plain English
A medium-severity regular-expression denial of service in micromatch from micromatch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-micromatch | no fix listed | DEBIAN-CVE-2024-4067 |
| Debian:13 | node-micromatch | 4.0.7+~4.0.7-1 | DEBIAN-CVE-2024-4067 |
| Debian:14 | node-micromatch | 4.0.7+~4.0.7-1 | DEBIAN-CVE-2024-4067 |
| Ubuntu:22.04:LTS | node-micromatch | no fix listed | UBUNTU-CVE-2024-4067 |
| Ubuntu:24.04:LTS | node-micromatch | no fix listed | UBUNTU-CVE-2024-4067 |
| Ubuntu:25.10 | node-micromatch | no fix listed | UBUNTU-CVE-2024-4067 |
| Ubuntu:26.04:LTS | node-micromatch | no fix listed | UBUNTU-CVE-2024-4067 |
| Ubuntu:26.10 | node-micromatch | no fix listed | UBUNTU-CVE-2024-4067 |
| npm | micromatch | 4.0.8 | GHSA-952p-6rrq-rcjv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| micromatch | micromatch | 0 – before 4.0.8 |
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://devhub.checkmarx.com/cve-details/CVE-2024-4067/
- https://github.com/micromatch/micromatch/pull/266
- https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
- https://github.com/micromatch/micromatch/releases/tag/4.0.8
- https://advisory.checkmarx.net/advisory/CVE-2024-4067/
- https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448 x_transferred
- https://github.com/micromatch/micromatch/issues/243 x_transferred
- https://github.com/micromatch/micromatch/pull/247 x_transferred