Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Passport-SAML: Malicious SAML payload causes denial-of-service

CVE-2021-39171 · published 5 years ago
Summary

Passport-SAML, a library used for authentication, is vulnerable to a denial-of-service attack. An attacker can send a malicious message that overloads the system, causing it to slow down or stop working. Update to version 3.1.0 or later to fix this issue.

What to do
  • Update cjbarth passport-saml to version 3.1.0.
  • Update passport-saml_project passport-saml to version 3.1.0 or later.
Affected software
Ecosystem VendorProductAffected versions
npm cjbarth passport-saml < 3.1.0
Fix: upgrade to 3.1.0
– passport-saml_project passport-saml < 3.1.0
cpe:2.3:a:passport-saml_project:passport-saml:*:*:*:*:*:node.js:*:*
Original advisory text
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significan...
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published27 Aug 2021
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-5379-r78w-42h2 · GHSA
CVE-2021-39171 · NVD
Track software like this
Free during beta