Liran Tal • 4/16/2023

Disclosing uncontrolled resource consumption in xmlhttprequest library

The article details a security vulnerability (CWE-400) discovered in the xmlhttprequest npm library, which lacks timeout controls for outgoing HTTP requests. This allows attackers to force connections to hang indefinitely, potentially saturating server I/O resources. It includes proof-of-concept exploit code and discusses the maintainer's response.

0 comments

#Node.js #NPM Package #Xmlhttprequest