User input results in Unbounded resource consumption in @zxcvbn-ts/core
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using the second argument of the zxcvbn function. It can result in an unbounded resource consumption as the user inputs array is extended with every function call. Browsers are impacted, too but a single user need to do a lot of input changes so that it affects the browser, while the node process gets the inputs of every user of a platform and can be killed that way. This problem has been patched in version 3.0.2. Users are advised to upgrade. Users unable to upgrade should stop using the second argument of the zxcvbn function and use the zxcvbnOptions.setOptions function.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zxcvbn-ts | zxcvbn | before 3.0.2 | 3.0.2 | Patch available | CNA |
- zxcvbn Vendorzxcvbn-ts Affected before 3.0.2 Fixed in 3.0.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zxcvbn-ts_project:zxcvbn-ts:*:*:*:*:*:node.js:*:* | before 3.0.2 | Vulnerable | Zxcvbn-ts Project |
- cpe:2.3:a:zxcvbn-ts_project:zxcvbn-ts:*:*:*:*:*:node.js:*:* Versions before 3.0.2 Vulnerable ·Zxcvbn-ts Project
Remediation
- Fix · CNA zxcvbn (zxcvbn-ts) Fixed in 3.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34109
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences