PT-2023-12132 · Suchmokuo · Node-Worker-Threads-Pool

Exx8O · Published 2023-08-11 · Updated 2023-08-21 · CVE-2021-29057

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SUCHMOKUO node-worker-threads-pool version 1.4.3

Description An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool, allowing attackers to cause a denial of service. This issue can be mitigated by manually creating a timeout.

Recommendations For version 1.4.3, consider creating a timeout when using the StaticPool to mitigate the risk of denial of service, for example by using the setTimeout method on the executor, as shown in the provided example code.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2021-29057

GHSA-7VXC-Q7RV-QFJ8

Affected Products

Node-Worker-Threads-Pool

References · 7

• 🔥 https://github.com/SUCHMOKUO/node-worker-threads-pool/issues/20 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-29057 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29057 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7vxc-q7rv-qfj8 · Vendor Advisory
• https://github.com/SUCHMOKUO/node-worker-threads-pool · Note
• https://twitter.com/CVEnew/status/1690264426832707584 · Twitter Post
• https://t.me/cibsecurity/68368 · Telegram Post