CVE-2022-25881: Http-cache-semantics SSRF Vulnerability

CVE-2022-25881 Overview

CVE-2022-25881 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the http-cache-semantics npm package, a popular Node.js library used for HTTP caching policy calculations. The vulnerability exists in versions prior to 4.1.1 and can be exploited by sending malicious request header values to a server that uses this library to parse cache policies from incoming requests.

Critical Impact

Attackers can cause service disruption by crafting malicious HTTP request headers that trigger catastrophic regex backtracking, leading to denial of service conditions on affected servers.

Affected Products

• http-cache-semantics versions prior to 4.1.1 for Node.js
• Applications and services that depend on vulnerable versions of http-cache-semantics
• WebJars npm packaging of http-cache-semantics (Java ecosystem)

Discovery Timeline

• 2023-01-31 - CVE-2022-25881 published to NVD
• 2025-03-27 - Last updated in NVD database

Technical Details for CVE-2022-25881

Vulnerability Analysis

This vulnerability is classified under CWE-1333 (Inefficient Regular Expression Complexity), commonly known as Regular Expression Denial of Service (ReDoS). The http-cache-semantics library processes HTTP request headers to determine caching behavior. When parsing certain header values, the library utilizes regular expressions that can exhibit exponential time complexity when processing specially crafted input.

The vulnerability allows an unauthenticated remote attacker to send malicious HTTP request headers that cause the regular expression engine to enter a state of catastrophic backtracking. This results in excessive CPU consumption, effectively blocking the Node.js event loop and rendering the server unresponsive to legitimate requests.

Root Cause

The root cause of this vulnerability lies in inefficient regular expression patterns used within the library's header parsing logic. Regular expressions with certain constructs (such as nested quantifiers or overlapping patterns) can exhibit non-linear time complexity when matched against adversarial input strings. The affected code path is triggered when the server reads cache policy information from incoming request headers.

The vulnerable code section involves parsing HTTP header values where the regex pattern allows for excessive backtracking when confronted with inputs designed to maximize match attempts before ultimately failing.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a server that uses http-cache-semantics to process cache policies from request headers
2. Crafting HTTP requests with specially constructed header values designed to trigger regex backtracking
3. Sending these malicious requests to exhaust server CPU resources
4. Repeating the attack to maintain denial of service conditions

The attack is particularly effective because a single malicious request can consume significant CPU time, and the vulnerability affects the main Node.js event loop, blocking all concurrent request processing.

For technical details on the vulnerable code pattern, refer to the GitHub Cache Semantics Code and the Snyk Vulnerability SNYK-JS-3248783 advisory.

Detection Methods for CVE-2022-25881

Indicators of Compromise

• Unusual CPU spikes on Node.js application servers coinciding with HTTP requests containing abnormally long or complex header values
• Slow or unresponsive application behavior without corresponding increase in legitimate traffic
• Request logs showing HTTP headers with repetitive patterns or unusually long strings in cache-related headers
• Event loop lag metrics showing significant degradation during specific request processing

Detection Strategies

• Implement application performance monitoring (APM) to detect abnormal CPU utilization patterns in Node.js processes
• Configure web application firewalls (WAF) to flag or block requests with excessively long or malformed HTTP header values
• Use dependency scanning tools such as Snyk, npm audit, or OWASP Dependency-Check to identify vulnerable versions of http-cache-semantics in your dependency tree
• Deploy runtime application self-protection (RASP) solutions to detect and block ReDoS attack patterns

Monitoring Recommendations

• Monitor Node.js event loop lag and CPU utilization metrics for anomalous spikes
• Set up alerts for request processing times that exceed normal thresholds
• Implement request header size limits at the load balancer or reverse proxy level
• Regularly audit application dependencies for known vulnerabilities using automated scanning in CI/CD pipelines

How to Mitigate CVE-2022-25881

Immediate Actions Required

• Upgrade http-cache-semantics to version 4.1.1 or later immediately
• Audit your application's dependency tree using npm ls http-cache-semantics to identify all instances of the vulnerable package
• Review transitive dependencies that may include vulnerable versions of the library
• Consider implementing request header size limits as an additional defense layer

Patch Information

The vulnerability is resolved in http-cache-semantics version 4.1.1. The fix addresses the inefficient regular expression patterns that caused the ReDoS condition. Organizations should update to this version or later to remediate the vulnerability.

For additional context, refer to the NetApp Security Advisory and the Snyk Vulnerability SNYK-JAVA-3253332 for Java ecosystem impacts.

Workarounds

• Implement input validation at the application or WAF level to reject requests with abnormally long or malformed header values
• Configure request header size limits in reverse proxies (e.g., nginx, HAProxy) to prevent excessively long headers from reaching the application
• Use rate limiting to mitigate the impact of repeated attack attempts from single sources
• Consider implementing request timeouts to prevent long-running regex operations from blocking the event loop indefinitely

# Update http-cache-semantics to patched version
npm update http-cache-semantics

# Or explicitly install the fixed version
npm install http-cache-semantics@4.1.1

# Audit dependencies for vulnerable packages
npm audit

# Check installed version
npm ls http-cache-semantics