CVE-2024-21539: ESLint Plugin Kit ReDoS Vulnerability

CVE-2024-21539 Overview

CVE-2024-21539 affects versions of the npm package @eslint/plugin-kit prior to 0.2.3. The package contains a Regular Expression Denial of Service (ReDoS) flaw caused by improper input sanitization in its configuration comment parser. An attacker who supplies a crafted configuration comment string can force catastrophic backtracking in the regular expression engine. This drives CPU usage to saturation and can crash the host process. The Common Weakness Enumeration identifiers associated with this issue are [CWE-1333] (Inefficient Regular Expression Complexity) and [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
A remote attacker can trigger sustained CPU exhaustion in any Node.js or build pipeline that invokes the vulnerable parser on attacker-controlled input.

Affected Products

@eslint/plugin-kit versions earlier than 0.2.3
Node.js applications and build pipelines that depend on the affected package directly or transitively
ESLint tooling and editor integrations bundling vulnerable releases of @eslint/plugin-kit

Discovery Timeline

2024-11-19 - CVE-2024-21539 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-21539

Vulnerability Analysis

The defect lives in packages/plugin-kit/src/config-comment-parser.js. The parser normalizes whitespace around : and , characters in configuration comment strings using a regular expression. The original pattern /\s*([:,])\s*/gu permits ambiguous matching of leading and trailing whitespace runs. When attacker-controlled input contains long sequences of whitespace, the engine evaluates many overlapping match positions before completing. This is a classic algorithmic complexity flaw classified under [CWE-1333].

Because the package is a transitive dependency in many JavaScript toolchains, the vulnerable code path is reachable wherever lint configuration comments are parsed from untrusted sources. The result is sustained CPU exhaustion and process unresponsiveness, consistent with the availability impact described in the advisory. The flaw does not expose data confidentiality or integrity.

Root Cause

The root cause is missing input trimming combined with a permissive whitespace pattern. The parser applied the substitution directly to unbounded input without first trimming surrounding whitespace, producing pathological backtracking on adversarial strings.

Attack Vector

The attack vector is network-reachable wherever the parser processes attacker-supplied configuration text, including pull requests, lint runs on untrusted repositories, and CI pipelines linting third-party code. No authentication or user interaction is required.

javascript

// Patch from packages/plugin-kit/src/config-comment-parser.js
const items = /** @type {StringConfig} */ ({});

// Collapse whitespace around `:` and `,` to make parsing easier
-const trimmedString = string.replace(/\s*([:,])\s*/gu, "$1");
+const trimmedString = string
+    .trim()
+    .replace(/(?<!\s)\s*([:,])\s*/gu, "$1");

trimmedString.split(/\s|,+/u).forEach(name => {
    if (!name) {

Source: GitHub Commit 071be84. The fix trims the input first and adds a negative lookbehind (?<!\s) so the engine cannot re-evaluate the same whitespace run multiple times.

Detection Methods for CVE-2024-21539

Indicators of Compromise

Node.js processes consuming 100% CPU on a single core while parsing lint configuration input
Lint, build, or CI jobs that hang or time out after ingesting pull request content or third-party repositories
Stack traces or profiler samples showing extended time in config-comment-parser.js or String.prototype.replace

Detection Strategies

Inventory direct and transitive dependencies with npm ls @eslint/plugin-kit and flag any version below 0.2.3
Run Software Composition Analysis (SCA) tools such as npm audit, Snyk, or GitHub Dependabot against project lockfiles
Capture CI job duration baselines and alert on outlier runs that exceed historical lint stage timing

Monitoring Recommendations

Track CPU utilization and wall-clock duration of Node.js lint and build processes in CI runners
Forward CI worker telemetry to a central data lake and alert on sustained single-core saturation during dependency scanning
Review pull request workflows that execute lint against untrusted contributor input for unusual job timeouts

How to Mitigate CVE-2024-21539

Immediate Actions Required

Upgrade @eslint/plugin-kit to version 0.2.3 or later across all projects and lockfiles
Regenerate package-lock.json or yarn.lock to remove vulnerable transitive copies
Rebuild and redistribute container images, serverless bundles, and CI runner images that include the package

Patch Information

The fix is published in @eslint/plugin-kit0.2.3. See the upstream change in the GitHub commit log and the Snyk vulnerability report for full advisory details.

Workarounds

Apply CI job timeouts to bound the impact of a single ReDoS trigger on lint stages
Restrict lint execution on untrusted pull requests until dependencies are updated
Pin @eslint/plugin-kit to 0.2.3 using package manager overrides if a direct upgrade is blocked by parent packages

bash

# Upgrade the package and verify the resolved version
npm install @eslint/plugin-kit@^0.2.3
npm ls @eslint/plugin-kit

# Force a transitive override in package.json if needed
# "overrides": { "@eslint/plugin-kit": "^0.2.3" }