jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

Security Vulnerability: Denial of Service (DoS) in jsdiff

Vulnerability Overview

A vulnerability has been identified in jsdiff where certain line break characters can lead to an infinite loop and potential memory exhaustion.

Impact

The parsePatch method is vulnerable to an infinite loop when processing filename headers containing specific line break characters: \r, \u2028, or \u2029.

Key risks:

• Memory Exhaustion: The process will consume memory indefinitely until it crashes (Out of Memory).
• Denial of Service (DoS): Attackers can trigger this with a very small payload; size limits on user input do not provide protection.
• Affected Methods: Both parsePatch and applyPatch (when used with string inputs) are affected.
• Secondary Issue: A lesser ReDOS (Regular Expression Denial of Service) exists in the patch header parsing, which can lead to $O(n^3)$ time complexity.

Patches

✅ All identified vulnerabilities have been fixed in v8.0.3.

Users are strongly encouraged to upgrade as soon as possible:

npm install [email protected]

See: https://github.com/kpdecker/jsdiff/pull/649