CVE-2021-39171

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an...

CVE-2021-39171 Unlimited transforms allowed for signed nodes

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an...

@3wks/gae-node-nestjs (>=0.1.0, <=6.0.0-rc.0), @aeroline_1025/hapi-corpsso (>=2.1.3, <=2.3.0) +72 more potentially affected by CVE-2021-39171 via passport-saml (>=0.5.2, <=2.2.0)

passport-saml NPM version =0.5.2, =0.1.0, =2.1.3, =1.0.0, =4.0.0-116, =0.0.0-nightly-20201012104, =3.4.2, =0.1.0, =1.0.0, =1.0.0, =2.4.0, =7.1.1, =6.2.2, =1.1.109, =1.3.78 and more Source cves: CVE-2021-39171 Source advisory: MEND:CVE-2021-39171...

CVE-2021-39171

Passport-SAML is affected by a resource-exhaustion issue in transforms prior to version 3.1.0, where a malicious SAML payload can cause high CPU/memory usage and deny service. The root cause is unrestricted transforms on signed nodes, which could lead to denial-of-service under crafted loads. The...