High, CVSS 7.5npmAmendedPublished
cumulative-distribution-function Infinite Loop vulnerability
CVE-2021-29486 · GHSA-58qp-5328-v7mh
- Affected
- npm cumulative-distribution-function < 2.0.0
- Fixed in
- 2.0.0· Vendor fix available
- Issue
- Impact Apps using this library on improper data may crash or go into an infinite-loop In the case of a nodejs server-app using this library to act on invalid non-numeric data, the nodejs server may crash. This may affect other users of this server and/or require the server to be rebooted for proper operation. In the case of a browser app using this library to act on invalid non-numeric data, that browser may crash or lock up. A flaw enabling an infinite-loop was discovered in the code for evaluating the cumulative-distribution-function of input data. Although the documentation explains that numeric data is required, some users may confuse an array of strings like ["1","2","3","4","5"] for numeric data [1,2,3,4,5] when it is in fact string data. An infinite loop is possible when the cumulative-distribution-function is evaluated for a given point when the input data is string data rather than type number. This vulnerability enables an infinite-cpu-loop denial-of-service-attack on any…
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.