GitHub Advisoryadvisory · npm
GHSA-7vxc-q7rv-qfj8 SUCHMOKUO node-worker-threads-pool denial of service Vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2021-29057
- Ecosystem
- npm
- Packages
- node-worker-threads-pool
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400, CWE-770
- Reviewed
- 2023-08-11
Affected packages
• npm node-worker-threads-pool: <= 1.4.3 (no fix yet)
Description
An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3 that allows attackers to cause a denial of service.
This can be mitigated by manually creating a timeout. For example:
```ts
const { StaticPool } = require(\"node-worker-threads-pool\");
const staticPool = new StaticPool({
size: 1,
task: (n) => {
while (n) {
console.log(\"a\");
}
return n;
}
});
staticPool.createExecutor().setTimeout(10).exec(1).then((result) => {
console.log(\"result from thread pool:\", result);
}).catch(() => console.error('timeout'));
```
Related
Alias · CVE (1)
- CVE-2021-29057 An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service. vulnerability