Description

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T17:17:22.180Z",
  "pubdate": "2026-08-13T17:17:22.180Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists within the tag endpoint of the affected NPM package, stemming from the utilization of unbounded `io.ReadAll` operations. This vulnerability allows remote, unauthenticated attackers to exhaust server resources by submitting maliciously crafted or excessively large payloads to the vulnerable endpoint.\nThe primary impact of this flaw is resource exhaustion, specifically memory depletion, which leads to application crashes, service unavailability, and potential cascading failures for dependent systems. The affected product processes incoming HTTP requests through the vulnerable tag endpoint without enforcing payload size restrictions or stream limits.\nThe risk implications are severe for availability, as service disruption can be triggered continuously with minimal attacker effort. Exploitation requires network access to the target application's exposed tag endpoint. No prior authentication, special privileges, or complex prerequisites are required to initiate the attack, making it accessible to any network-adjacent adversary capable of sending HTTP requests to the target service.",
  "technicalDetails": "The root cause of the vulnerability lies in the unsafe implementation of request body processing within the tag endpoint. Specifically, the underlying codebase employs the `io.ReadAll` function to consume the entire HTTP request body stream into memory without implementing any form of length validation, buffer caps, or chunked streaming limits.\nThe vulnerable component resides in the HTTP handler responsible for parsing tags within the NPM package. When an incoming request reaches the tag endpoint, the application reads the complete payload into an unconstrained byte slice allocated on the heap. Because `io.ReadAll` reads until encountering `io.EOF`, it will continue to ingest data as long as the client transmits it or until the system runs out of allocatable memory.\nThe attack flow proceeds as follows: An unauthenticated attacker initiates a standard HTTP POST or PUT request targeting the vulnerable tag endpoint. Instead of sending a standard payload size, the attacker transmits an exceptionally large payload—or utilizes a slow-loris style connection trickling infinite data—designed to consume gigabytes of memory. The application handler invokes `io.ReadAll` on the incoming request body. As the runtime attempts to allocate contiguous memory blocks to accommodate the incoming stream, the garbage collector struggles to keep pace, leading to out-of-memory (OOM) conditions.\nThe exploitation method relies entirely on memory exhaustion. Once the memory threshold is breached, the host operating system terminates the process via the OOM killer, or the Go runtime panics due to allocation failures, resulting in an immediate Denial of Service for all legitimate users.\nNetwork exposure is direct, as the tag endpoint must be accessible over the network to receive requests. No authentication or specific privileges are required to exploit this flaw, as the vulnerability manifests during the initial parsing phase of the request lifecycle, well before authentication or authorization checks are typically evaluated against the payload contents."
}