CVE-2025-43880: GROWI Denial of Service (DoS) Vulnerability

CVE-2025-43880 Overview

CVE-2025-43880 is an inefficient regular expression complexity vulnerability in GROWI, an open-source wiki platform developed by WESEEK. The flaw affects GROWI versions prior to v7.1.6 and is tracked under [CWE-1333]. An authenticated user can submit crafted input that triggers catastrophic backtracking in a vulnerable regular expression, exhausting CPU resources on the server.

Critical Impact
A logged-in user can trigger a denial of service (DoS) condition against the GROWI application, degrading availability for all users of the affected instance.

Affected Products

GROWI versions prior to v7.1.6
WESEEK GROWI open-source wiki platform
Self-hosted GROWI deployments running unpatched releases

Discovery Timeline

2025-06-25 - CVE-2025-43880 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43880

Vulnerability Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) issue classified under [CWE-1333], Inefficient Regular Expression Complexity. GROWI processes user-supplied input against a regular expression whose evaluation time grows disproportionately with input length or structure. When an attacker submits crafted input matching a pathological pattern, the regex engine enters catastrophic backtracking. The Node.js event loop is single-threaded, so a single expensive regex evaluation blocks request processing for all concurrent users.

Exploitation requires an authenticated account, which limits the exposure to environments where user registration is open or where credentials are otherwise obtainable. See GitHub Pull Request #9487 for the upstream fix and JVN Vulnerability Report JVN21624250 for the coordinated advisory.

Root Cause

The root cause is a regular expression pattern in GROWI that lacks safeguards against superlinear matching complexity. Ambiguous quantifiers or nested repetition allow input strings to produce exponential or polynomial evaluation paths. This class of bug commonly arises when developer-authored regex handles free-form user content without input length limits or timeout guards.

Attack Vector

The attack vector is network-based and requires low privileges. An authenticated user issues an HTTP request to a GROWI endpoint that passes user-controlled input into the vulnerable regex. The server thread evaluating the expression becomes CPU-bound, delaying or blocking response handling for subsequent requests. Repeated submissions amplify the effect and can render the instance unresponsive.

No verified public proof-of-concept has been released. Refer to the upstream pull request for the specific pattern and fix.

Detection Methods for CVE-2025-43880

Indicators of Compromise

Sustained high CPU utilization on the Node.js process hosting GROWI without a corresponding rise in traffic volume
HTTP request latency spikes, request queue growth, and health-check timeouts on the GROWI service
Repeated requests from a single authenticated session containing unusually long or repetitive input strings to wiki or search endpoints

Detection Strategies

Correlate application performance monitoring (APM) metrics with authentication logs to identify sessions that precede CPU saturation events
Enable slow-request logging in the reverse proxy or GROWI application layer to capture requests exceeding a defined processing threshold
Review web server access logs for large request bodies or query parameters directed at input-processing endpoints

Monitoring Recommendations

Configure alerts on Node.js event loop lag and process CPU consumption for GROWI containers or hosts
Track authenticated user request rates and flag accounts generating anomalous volumes of write or search operations
Forward GROWI application, reverse proxy, and host telemetry to a centralized log platform for correlation and retention

How to Mitigate CVE-2025-43880

Immediate Actions Required

Upgrade GROWI to version v7.1.6 or later, which contains the fix delivered in GitHub Pull Request #9487
Audit user accounts and disable inactive or unknown accounts to reduce the pool of principals able to trigger the flaw
Restrict self-service registration on internet-facing GROWI instances until patching is complete

Patch Information

The vendor fix is included in GROWI v7.1.6. The upstream patch is documented in GitHub Pull Request #9487, and the coordinated advisory is published as JVN21624250. Administrators should validate the deployed version after upgrade and confirm the patched regex handling is present.

Workarounds

Place GROWI behind a reverse proxy or web application firewall (WAF) that enforces request size limits and per-user rate limiting
Apply CPU and memory resource limits at the container or process level so that a single overloaded worker does not starve the host
Restrict access to authenticated GROWI endpoints to trusted network ranges using network access controls until the patch is applied

bash

# Example nginx configuration to limit request size and rate for GROWI
http {
    limit_req_zone $binary_remote_addr zone=growi_rl:10m rate=10r/s;

    server {
        listen 443 ssl;
        server_name growi.example.com;

        client_max_body_size 1m;

        location / {
            limit_req zone=growi_rl burst=20 nodelay;
            proxy_pass http://growi_backend;
            proxy_read_timeout 15s;
        }
    }
}