Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-4437: dbartholomae Lambda-Middleware Frameguard 1.0.4 has a Potentially Slow JSON Parsing Issue

CVE-2021-4437 · published 2 years ago

Summary

A weakness has been discovered in the JSON parsing functionality of dbartholomae Lambda-Middleware Frameguard versions up to 1.0.4. This could lead to slower performance. To fix this, upgrade to version 1.1.0.

What to do

Update lambda-middleware json-deserializer to version 1.1.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	lambda-middleware	json-deserializer	< 1.1.0 Fix: upgrade to 1.1.0
–	dbartholomae	lambda-middleware	<= 1.0.4 `cpe:2.3:a:dbartholomae:lambda-middleware::::::::`

Original advisory text

A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some unknown functionality of the file packages/json-deserializer/src/JsonDeserializer.ts of the component JSON Mime-Type Handler. The manipulation leads to inefficient regular expression complexity. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as f689404d830cbc1edd6a1018d3334ff5f44dc6a6. It is recommended to upgrade the affected component. VDB-253406 is the identifier assigned to this vulnerability.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-1333Inefficient Regular Expression Complexity (ReDoS)

Timeline

Published12 Feb 2024

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-m3f4-957x-m785 · GHSA

CVE-2021-4437 · NVD

Track software like this

Free during beta