VYPR
← All advisories
High severityNVD Advisory· Published May 24, 2021· Updated Aug 3, 2024

CVE-2021-33502

CVE-2021-33502

Description

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The normalize-url package for Node.js before versions 4.5.1, 5.3.1, and 6.0.1 is vulnerable to ReDoS via crafted data: URLs.

Vulnerability

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js contains a regular expression denial of service (ReDoS) vulnerability. The issue resides in the normalizeDataURL function, which uses the regex /^data:(?.*?),(?.*?)(?:#(?.*))?$/. This regex exhibits exponential backtracking when processing specially crafted data: URLs, leading to excessive CPU consumption [1][2][4].

Exploitation

An attacker can exploit this vulnerability by providing a maliciously crafted data: URL to an application that uses the vulnerable normalize-url function. No authentication or special privileges are required; the attacker only needs to supply the URL via any input vector (e.g., HTTP request, file upload). The crafted URL contains a pattern that triggers catastrophic backtracking in the regex, causing exponential processing time [2][4]. The commit that fixes the issue includes a test demonstrating the performance problem with URLs containing many ,# sequences [4].

Impact

Successful exploitation results in a denial of service (DoS) condition. The application becomes unresponsive or consumes excessive CPU resources, potentially affecting availability for legitimate users. The impact is limited to availability; no data confidentiality or integrity is compromised [2].

Mitigation

The vulnerability is fixed in versions 4.5.1, 5.3.1, and 6.0.1 of the normalize-url package [1][3]. Users should upgrade to these patched versions. The fix changes the regex to use non-greedy quantifiers with character classes to prevent backtracking [4]. No workarounds are documented; upgrading is the recommended action.

References
  1. GitHub - sindresorhus/normalize-url: Normalize a URL
  2. NVD - CVE-2021-33502
  3. Release v6.0.1 · sindresorhus/normalize-url
  4. Fix ReDoS for data URLs · sindresorhus/normalize-url@b1fdb51

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
normalize-urlnpm
>= 4.3.0, < 4.5.14.5.1
normalize-urlnpm
>= 5.0.0, < 5.3.15.3.1
normalize-urlnpm
>= 6.0.0, < 6.0.16.0.1

Affected products

10

Patches

1
b1fdb5120b6d

Fix ReDoS for data URLs

https://github.com/sindresorhus/normalize-urlSindre SorhusMay 21, 2021via ghsa
commit
2 files changed · +15 −1
  • index.js+1 −1 modified
    @@ -9,7 +9,7 @@ const testParameter = (name, filters) => {
 };
 
 const normalizeDataURL = (urlString, {stripHash}) => {
-	const match = /^data:(?<type>.*?),(?<data>.*?)(?:#(?<hash>.*))?$/.exec(urlString);
+	const match = /^data:(?<type>[^,]*?),(?<data>[^#]*?)(?:#(?<hash>.*))?$/.exec(urlString);
 
 	if (!match) {
 		throw new Error(`Invalid URL: ${urlString}`);
  • test.js+14 −0 modified
    @@ -344,3 +344,17 @@ test('view-source URL', t => {
 		normalizeUrl('view-source:https://www.sindresorhus.com');
 	}, '`view-source:` is not supported as it is a non-standard protocol');
 });
+
+test('does not have exponential performance for data URLs', t => {
+	for (let index = 0; index < 1000; index += 50) {
+		const url = 'data:' + Array.from({length: index}).fill(',#').join('') + '\ra';
+		const start = Date.now();
+
+		try {
+			normalizeUrl(url);
+		} catch {}
+
+		const difference = Date.now() - start;
+		t.true(difference < 100, `Execution time: ${difference}`);
+	}
+});

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.