CVE-2021-33502 Overview
CVE-2021-33502 is a Regular Expression Denial of Service (ReDoS) vulnerability in the normalize-url package for Node.js. The flaw affects versions before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1. The package exhibits exponential performance characteristics when processing data: URLs, allowing attackers to trigger catastrophic backtracking through crafted input. This issue is classified under [CWE-1333] (Inefficient Regular Expression Complexity).
Critical Impact
A remote attacker can submit a crafted data: URL to any application using a vulnerable version of normalize-url, causing CPU exhaustion and rendering the service unresponsive.
Affected Products
- normalize-url package versions before 4.5.1
- normalize-url package versions 5.x before 5.3.1
- normalize-url package versions 6.x before 6.0.1
Discovery Timeline
- 2021-05-24 - CVE-2021-33502 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2021-33502
Vulnerability Analysis
The normalize-url package normalizes URLs by performing operations such as removing trailing slashes, sorting query parameters, and standardizing schemes. The library uses regular expressions to parse and rewrite URL components, including the data: URI scheme. One of these regular expressions exhibits exponential time complexity when fed specifically crafted input.
When an attacker supplies a malicious data: URL, the regular expression engine enters a catastrophic backtracking state. The execution time grows exponentially with the length of the input string. This blocks the single-threaded Node.js event loop and prevents the process from handling other requests.
The vulnerability has network attack vector characteristics and requires no authentication or user interaction. Any web service that calls normalize-url on attacker-controlled input is exposed.
Root Cause
The root cause is an inefficient regular expression used to process data: URLs within the normalization logic. The regex contains ambiguous quantifiers that allow multiple ways to match the same substring. This ambiguity triggers exponential backtracking on adversarial input, consuming CPU until the input is exhausted or the process is terminated.
Attack Vector
Exploitation requires submitting attacker-controlled input that reaches a call to normalizeUrl(). Common entry points include user-submitted URL fields, RSS feed parsers, web crawlers, link preview generators, and HTTP clients that normalize redirect targets. A single malicious request can stall a worker process for seconds to minutes. Repeated requests can fully exhaust application capacity and produce sustained denial of service.
No verified public proof-of-concept code is available in the referenced advisories. See the GitHub Release v6.0.1 notes and the NetApp Security Advisory ntap-20210706-0001 for additional technical context.
Detection Methods for CVE-2021-33502
Indicators of Compromise
- Sustained spikes in Node.js process CPU usage tied to specific HTTP request handlers.
- Inbound HTTP requests containing unusually long data: URL parameters in query strings, POST bodies, or JSON fields.
- Application response time degradation or event loop lag warnings emitted by Node.js runtime monitoring.
- Connection timeouts and 502/504 responses from upstream proxies when the affected service stops responding.
Detection Strategies
- Inventory all Node.js applications and inspect package-lock.json and yarn.lock for normalize-url versions below 4.5.1, 5.3.1, or 6.0.1.
- Run npm audit or yarn audit across CI/CD pipelines to flag the vulnerable package transitively.
- Add Software Composition Analysis (SCA) scanning to development workflows to identify dependencies with known ReDoS issues tagged under [CWE-1333].
- Deploy a Web Application Firewall (WAF) rule to inspect request payloads for oversized data: URI patterns.
Monitoring Recommendations
- Track event loop latency metrics using perf_hooks or APM agents and alert on sustained delays above baseline.
- Log HTTP request payload sizes and flag entries containing data: URIs longer than a defined threshold.
- Correlate request patterns with CPU saturation events to identify exploitation attempts.
How to Mitigate CVE-2021-33502
Immediate Actions Required
- Upgrade normalize-url to version 4.5.1, 5.3.1, or 6.0.1 or later depending on the major version branch in use.
- Audit transitive dependencies, since normalize-url is frequently pulled in by other packages without direct declaration.
- Apply input length limits and request body size limits at the reverse proxy or application layer to bound regex execution time.
- Run dependency updates through staging environments to confirm no behavioral changes affect downstream code.
Patch Information
The maintainer addressed the ReDoS issue in normalize-url v6.0.1, with backports to the 4.x and 5.x branches. NetApp also published platform-specific guidance in the NetApp Security Advisory ntap-20210706-0001 for affected products that bundle the library.
Workarounds
- Reject or strip data: URLs before passing input to normalize-url if the application does not require them.
- Enforce a maximum URL length at the application boundary, rejecting requests with URL fields above a few kilobytes.
- Wrap calls to normalizeUrl() in a worker thread or child process with an execution timeout to prevent event loop blocking.
# Upgrade normalize-url to a fixed version
npm install normalize-url@^6.0.1
# Verify resolved version in the dependency tree
npm ls normalize-url
# Audit for remaining vulnerable instances
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
