Vulnerability: Denial of Service in ecstatic `ecstatic`, a simple static file server middleware, is vulnerable to denial of service. If a payload with a large number of null bytes (`%00`) is provided by an attacker it can crash ecstatic by running it out of memory.


[Results from the original advisory](https://www.checkmarx.com/advisories/denial-of-service-dos-vulnerability-in-ecstatic-npm-package/)

```
A payload of 22kB caused a lag of 1 second,
A payload of 35kB caused a lag of 3 seconds,
A payload of 86kB caused the server to crash
```


## Recommendation

Update to version 2.0.0 or later.
Vulnerability ID: GHSA-pm9p-9926-w68m
CWE: CWE-20
Severity score: 7.5
Project: https://github.com/jfhbrook/node-ecstatic
Published: 2017-12-28
File: lib/ecstatic.js
Commit message: Remove stripping of null bytes

This was at one point necessary because of an old bug in url.parse

See: https://github.com/jfhbrook/node-ecstatic/issues/16#issuecomment-3039914
See: https://github.com/jfhbrook/node-ecstatic/commit/43f7e72a31524f88f47e367c3cc3af710e67c9f4

But this opens up a regex dos attack vector! D:

Based on some research (ie asking #node-dev if this is still an issue),
it's *probably* not an issue. :)
Commit author: Joshua Holbrook

Vulnerable version (before fix):
 var ecstatic = module.exports = function (dir, options) {   return function middleware (req, res, next) {      // Strip any null bytes from the url     while(req.url.indexOf('%00') !== -1) {       req.url = req.url.replace(/\%00/g, '');     }     // Figure out the path for the file from the given url     var parsed = url.parse(req.url);     try {

Fixed version (after fix):
 var ecstatic = module.exports = function (dir, options) {   return function middleware (req, res, next) {      // Strip any null bytes from the url     // This was at one point necessary because of an old bug in url.parse     //     // See: https://github.com/jfhbrook/node-ecstatic/issues/16#issuecomment-3039914     // See: https://github.com/jfhbrook/node-ecstatic/commit/43f7e72a31524f88f47e367c3cc3af710e67c9f4     //     // But this opens up a regex dos attack vector! D:     //     // Based on some research (ie asking #node-dev if this is still an issue),     // it's *probably* not an issue. :)     /*     while(req.url.indexOf('%00') !== -1) {       req.url = req.url.replace(/\%00/g, '');     }     */      // Figure out the path for the file from the given url     var parsed = url.parse(req.url);     try {

Patch:
patch: @@ -52,9 +52,21 @@ var ecstatic = module.exports = function (dir, options) {
   return function middleware (req, res, next) {
 
     // Strip any null bytes from the url
+    // This was at one point necessary because of an old bug in url.parse
+    //
+    // See: https://github.com/jfhbrook/node-ecstatic/issues/16#issuecomment-3039914
+    // See: https://github.com/jfhbrook/node-ecstatic/commit/43f7e72a31524f88f47e367c3cc3af710e67c9f4
+    //
+    // But this opens up a regex dos attack vector! D:
+    //
+    // Based on some research (ie asking #node-dev if this is still an issue),
+    // it's *probably* not an issue. :)
+    /*
     while(req.url.indexOf('%00') !== -1) {
       req.url = req.url.replace(/\%00/g, '');
     }
+    */
+
     // Figure out the path for the file from the given url
     var parsed = url.parse(req.url);
     try {
path: lib/ecstatic.js