GHSA-q5pr-72pq-83v3: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
SummaryThe `setChunkedCookie()` and `deleteChunkedCookie()` functions in h3 trust the chunk count parsed from a user-controlled cookie value (`__chunked__N`) without any upper bound validation. An unauthenticated attacker can send a single request with a crafted cookie header (e.g., `Cookie: h3=__chunked__999999`) to any endpoint using sessions, causing the server to enter an O(n²) loop that hangs the process.DetailsThe chunked cookie system stores large cookie values by splitting them into numbered chunks. The main cookie stores a sentinel value `__chunked__N` indicating how many chunks exist. When setting a new chunked cookie, the code cleans up any previous chunks that are no longer needed.The vulnerability is in `getChunkedCookieCount()` at `src/utils/cookie.ts:244-249`:This value is consumed without validation in the cleanup loop of `setChunkedCookie()` at `src/utils/cookie.ts:182-190`:The same issue exists in `deleteChunkedCookie()` at `src/utils/cookie.ts:227-232`:**The exploit chain through sessions:**Attacker sends `Cookie: h3=__chunked__999999` to any session-using endpoint`getSession()` (`src/utils/session.ts:83`) calls `getChunkedCookie(event, "h3")` (line 124)`getChunkedCookie()` returns `undefined` — the early return at line 153 fires because no actual chunk cookies (e.g., `h3.1`) exist in the requestSince `sealedSession` is undefined, `session.id` remains empty (line 140), triggering `updateSession()` (line 143)`updateSession()` calls `setChunkedCookie()` with the newly sealed session value (line 179)Inside `setChunkedCookie()`, `getCookie(event, name)` re-reads the original request cookie `__chunked__999999` at line 182`previousChunkCount` = 999999, `chunkCount` = 1 (new sealed session is small)The cleanup loop runs 999,998 iterations, each calling `deleteCookie()` → `setCookie()`Each `setCookie()` call reads ALL existing `set-cookie` response headers via `getSetCookie()` (line 91) and iterates through them for deduplication (lines 100-106)This creates O(n²) complexity — approximately 10¹² operations for n=999999**Key observation:** While `getChunkedCookie()` has an early-return optimization (line 153) that prevents it from looping on missing chunks, the cleanup loops in `setChunkedCookie()` and `deleteChunkedCookie()` have no such protection and run unconditionally for the full claimed chunk count.PoC**Prerequisites:** An h3 application with any endpoint using `getSession()` or `useSession()`.Example minimal server:**Attack (single request, no authentication):**For a less extreme but still impactful test:The `deleteChunkedCookie()` path is exploitable via `clearSession()`:Impact**Complete Denial of Service**: A single unauthenticated request with a 27-byte cookie header can hang the server process indefinitely. Node.js is single-threaded, so this blocks all request handling.**No authentication required**: The attack only requires the ability to send HTTP requests with a crafted cookie header.**Minimal attacker effort**: The payload is trivially small (`Cookie: h3=__chunked__999999`), making it easy to automate or repeat.**Wide attack surface**: Any endpoint in the application that uses `getSession()`, `useSession()`, or `clearSession()` is vulnerable. Session usage is extremely common in web applications.**Amplification**: The ratio of attacker input (27 bytes) to server work (billions of operations) is extreme.Recommended FixAdd a maximum chunk count constant and validate in `getChunkedCookieCount()`:This clamps the parsed count at a safe maximum. Since each chunk can hold ~4000 bytes and 100 chunks would allow ~400KB of cookie data (far beyond any practical limit), `MAX_CHUNKED_COOKIE_COUNT = 100` is generous while eliminating the DoS vector.Additionally, the callers should be updated to handle `NaN` safely. The cleanup loop in `setChunkedCookie()` already handles this correctly since `NaN > chunkCount` is false, so the loop won't execute. The `deleteChunkedCookie()` loop also handles it since `NaN >= 0` is false.
CVSS v3.1: 5.3