Lodash Regular Expression Denial-of-Service Vulnerability

A Regular Expression Denial-of-Service (ReDoS) vulnerability has been identified in Lodash versions prior to 4.17.21. This vulnerability arises in the `toNumber`, `trim`, and `trimEnd` functions, where specially crafted input can cause excessive backtracking in the regular expression engine. As a result, the vulnerability can be exploited to create a denial-of-service condition by consuming a significant amount of CPU resources, thereby slowing down or crashing the application.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, where the application becomes unresponsive or significantly slower due to excessive CPU consumption.

Reproduction

The vulnerability can be reproduced by using Lodash versions prior to 4.17.21 and calling the `toNumber`, `trim`, or `trimEnd` functions with carefully crafted input that exploits the regular expression processing. This can be done by creating a string that includes a large number of characters that the regular expression will process inefficiently, causing the function to take a long time to return a result.

Remediation

Users are advised to upgrade Lodash to version 4.17.21 or later.