CVE-2021-41167 Unlimited requests in modern-async

2021-10-2018:25:12

CWE-400

GitHub_M

www.cve.org

modern-async

javascript

async/await

promises

bug

foreachseries

foreachlimit

concurrency

security issue

patch

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

64.6%

JSON

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don’t. Any code calling these functions will be written thinking they would limit the concurrency but they won’t. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.

CNA Affected

[
  {
    "product": "modern-async",
    "vendor": "nicolas-van",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.0.4"
      }
    ]
  }
]