CVE-2025-70034: mscdex ssh2 ReDoS Vulnerability

CVE-2025-70034 Overview

A Regular Expression Denial of Service (ReDoS) vulnerability has been discovered in mscdex ssh2 version 1.17.0. The vulnerability stems from inefficient regular expression complexity (CWE-1333), which can be exploited by an attacker to cause excessive CPU consumption, leading to denial of service conditions. The ssh2 library is a popular SSH2 client and server implementation for Node.js, making this vulnerability potentially impactful for applications relying on this module for secure communications.

Critical Impact

Attackers can exploit the inefficient regex pattern to cause catastrophic backtracking, resulting in application hangs and denial of service without requiring authentication.

Affected Products

• mscdex ssh2 v1.17.0
• Node.js applications utilizing the vulnerable ssh2 library version

Discovery Timeline

• 2026-03-09 - CVE CVE-2025-70034 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-70034

Vulnerability Analysis

This vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity), commonly referred to as Regular Expression Denial of Service (ReDoS). The ssh2 library contains a regular expression pattern that exhibits exponential time complexity when processing specially crafted input strings. When the regex engine encounters certain malicious input patterns, it enters a state of catastrophic backtracking, consuming excessive CPU resources and effectively blocking the event loop in Node.js applications.

The vulnerability can be triggered remotely over the network without requiring any authentication or user interaction. An attacker can send maliciously crafted SSH protocol data that triggers the vulnerable regex, causing the target application to become unresponsive. This is particularly concerning for SSH server implementations using this library, as they would be directly exposed to untrusted network input.

Root Cause

The root cause lies in a poorly constructed regular expression pattern within the ssh2 library that does not properly bound the complexity of matching operations. Regular expressions with nested quantifiers or overlapping alternations can exhibit O(2^n) time complexity when certain input patterns are provided. The lack of input length restrictions or regex timeout mechanisms exacerbates the vulnerability, allowing even moderately sized malicious inputs to cause significant delays.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft malicious input data designed to trigger the vulnerable regex pattern during SSH protocol parsing or handling. By sending this crafted input to an application using the vulnerable ssh2 library, the attacker can cause:

1. CPU Exhaustion - The regex engine consumes 100% CPU during backtracking
2. Event Loop Blocking - Node.js single-threaded nature means the entire application becomes unresponsive
3. Service Degradation - Legitimate requests cannot be processed while the regex is executing
4. Cascading Failures - In clustered environments, multiple workers may be affected

The attack requires minimal resources to execute but can have significant impact on target systems. A proof of concept demonstrating this vulnerability is available through the GitHub Gist PoC.

Detection Methods for CVE-2025-70034

Indicators of Compromise

• Sudden CPU spikes to 100% on systems running Node.js applications with ssh2
• Node.js processes becoming unresponsive to health checks or API requests
• Increased SSH connection timeouts or failures in application logs
• Event loop lag metrics showing sustained high latency periods

Detection Strategies

• Monitor Node.js process CPU utilization for sustained high consumption patterns
• Implement application performance monitoring (APM) to track event loop blocking events
• Review dependency manifests (package.json, package-lock.json) for ssh2 version 1.17.0
• Configure network intrusion detection to flag unusual SSH handshake patterns

Monitoring Recommendations

• Set up alerting on Node.js event loop lag exceeding normal thresholds
• Deploy log analysis to correlate SSH connection events with CPU anomalies
• Use runtime application self-protection (RASP) to detect regex-based DoS attempts
• Implement connection rate limiting on SSH endpoints to reduce attack surface

How to Mitigate CVE-2025-70034

Immediate Actions Required

• Audit all applications for usage of mscdex ssh2 version 1.17.0
• Check for available updates to the ssh2 library and upgrade immediately if a patched version exists
• Implement input validation and length restrictions on data processed by the library
• Consider deploying a Web Application Firewall (WAF) or network-level filtering for SSH services

Patch Information

Check the GitHub SSH2 Library repository for the latest releases and security advisories. Monitor the project's issue tracker and releases page for patches addressing this vulnerability. Until a patch is available, apply the workarounds listed below to reduce exposure.

Workarounds

• Implement connection rate limiting to reduce the impact of repeated attack attempts
• Deploy the application behind a reverse proxy that can timeout long-running requests
• Use Node.js worker threads to isolate SSH handling from the main event loop
• Consider alternative SSH2 libraries if no patch becomes available in a timely manner
• Implement network-level filtering to restrict SSH access to trusted IP ranges only

# Configuration example - Rate limiting with iptables
# Limit new SSH connections to 10 per minute per source IP
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP