Description

plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T21:17:08.567Z",
  "pubdate": "2026-11-06T21:17:08.567Z",
  "executiveSummary": "The plist npm package, specifically versions prior to 5.0.1, contains an uncontrolled resource consumption vulnerability within its binary property-list parser, parseBinary.\nThis flaw allows unauthenticated attackers to trigger an unrecoverable out-of-memory (OOM) crash, resulting in a denial-of-service (DoS) condition for the underlying Node.js process.\nThe vulnerability originates from unmemoized recursive resolution logic when parsing shared object references for arrays and dictionaries within binary plist data.\nBy crafting a malicious binary plist payload—often smaller than 200 bytes—an attacker can induce exponential resolution cycles (2^N), leading to rapid, uncontrolled memory exhaustion.\nThis attack requires no special authentication or elevated privileges and can be executed over any network interface that accepts binary plist input.\nThe risk is significant due to the ease of exploitation, the minimal payload size required to induce a crash, and the lack of resource constraints in the vulnerable parsing function, which directly threatens the availability of applications dependent on this library.",
  "technicalDetails": "The vulnerability resides in the parseBinary function of the plist.js library, which is responsible for decoding binary-formatted Apple property lists. The root cause is a failure to properly track or memoize recursive object references during the traversal of the plist structure.\nIn the binary plist format, objects such as arrays and dictionaries can contain shared object references (indices pointing to other elements). The implementation of parseBinary employs a recursive resolution strategy that attempts to resolve these shared references without validating for circularities or maintaining a cache of already-resolved objects. When an attacker crafts a malicious payload containing chained self-referencing indices, the parser enters an exponential recursion pattern. Specifically, every reference to an object that in turn references others causes the parser to re-visit and re-resolve the underlying structure multiple times, resulting in a computational complexity of O(2^N).\nThe attack flow proceeds as follows: First, the attacker creates a small (under 200 bytes) binary plist file. This payload is structured to include nested, interconnected object indices that form a complex graph of self-references. Upon receipt, the application passes this payload to the plist.parseBinary function. As the function begins parsing, it encounters the first nested reference and recursively enters the resolution logic. Due to the lack of memoization, the parser does not recognize that it is traversing the same branches repeatedly. As the recursion depth increases, the number of function calls and the temporary memory allocation for the recursive stack grow exponentially. This rapid expansion consumes all available heap memory within the Node.js process almost instantaneously.\nThe component affected is the binary parser within the plist package. Versions prior to 5.0.1 are vulnerable as they lack the necessary logical checks to break these recursive chains. The exploitation is trivial and does not require authentication or specific privilege levels; the only requirement is that the targeted application allows an external user to supply a binary plist to the parsing function. The consequence is a complete crash of the Node.js runtime, as the memory exhaustion is typically unrecoverable within the scope of the event loop, effectively halting the service and creating a persistent denial-of-service condition."
}