GHSA-h6ch-v84p-w6p9

What it actually does

This vulnerability is a Regular Expression Denial of Service issue in affected uses of the diff npm package, including downstream packaged applications such as Bitnami Grafana. A crafted input can trigger pathological regular-expression backtracking, causing the JavaScript runtime to spend excessive CPU time processing the input. The flaw does not directly provide code execution or data access, but it can block request handling, worker threads, or application processes that parse attacker-controlled diff-like input.

Why it matters to the business

Successful exploitation can make affected application functionality slow or unavailable, potentially degrading dashboards, APIs, CI/CD tooling, or other services that rely on the vulnerable package. Because diff is a widely reused npm component and Grafana is commonly deployed for operational monitoring, exposure may exist indirectly through packaged or embedded dependencies even where teams do not knowingly use the library. The issue is old and not listed in CISA KEV, but unpatched legacy deployments may still be vulnerable to low-cost denial-of-service attempts.

How an attack unfolds

An attacker identifies an application endpoint, workflow, plugin, or service feature that passes user-controlled text into the vulnerable diff library. The attacker sends specially crafted input designed to trigger excessive regular-expression backtracking. When the vulnerable code evaluates the input, the Node.js process consumes disproportionate CPU for the size of the request. Repeated requests or concurrent submissions can tie up event-loop capacity, exhaust worker availability, increase latency, and potentially cause service watchdogs, containers, or load balancers to restart or remove the instance from rotation. In downstream products, exploitation depends on whether the vulnerable parsing path is reachable through an exposed feature or integration.

How to fix it

Upgrade affected components to fixed versions or later: diff npm package version 3.5.0 or later, and Bitnami Grafana version 7.0.1 or later. Rebuild and redeploy applications that vendor, bundle, or lock older transitive versions of diff in package-lock.json, yarn.lock, pnpm-lock.yaml, container images, or appliance packages. If immediate upgrade is not possible, reduce exposure by limiting unauthenticated access to affected functionality, enforcing request body size limits, applying rate limits, setting CPU and request timeouts, and isolating vulnerable services behind authentication or trusted network controls. Dependency overrides or resolutions can be used cautiously to force a safe diff version after compatibility testing.

How to confirm the fix worked

Confirm that dependency inventory and runtime artifacts no longer include vulnerable diff versions earlier than 3.5.0, and that Bitnami Grafana packages are upgraded to 7.0.1 or later where applicable. Validate lockfiles, container image SBOMs, deployed node_modules directories, and package manager output such as npm ls diff. Exercise application features that perform diff operations with normal and large inputs to confirm expected behavior, bounded latency, and no CPU spikes. Review ingress controls, rate limits, and timeout settings to ensure mitigation remains in place for any endpoints that still process untrusted text.

Typical attack path

1. Identify an application or product version that includes a vulnerable diff npm package version before 3.5.0 or a Bitnami Grafana package before 7.0.1.
2. Find a reachable feature that accepts attacker-controlled text and invokes diff comparison or parsing logic.
3. Submit crafted input intended to trigger catastrophic regular-expression backtracking.
4. Observe elevated CPU usage, long response times, timeouts, or process instability.
5. Repeat or parallelize requests to sustain service degradation or denial of service.

How to detect it

Look for historical signs of denial-of-service activity rather than compromise artifacts. Relevant sources include web access logs, API gateway logs, reverse proxy logs, Node.js application logs, APM traces, container orchestration events, host CPU metrics, process restart records, and load balancer health-check failures. Investigate periods with sharp CPU spikes on Node.js or Grafana-related processes, increased request latency, HTTP 408/429/499/500/502/503/504 responses, event-loop lag alerts, out-of-memory or watchdog restarts, and repeated large POST/PUT requests to endpoints that perform text comparison, patch viewing, import, preview, dashboard, annotation, or diff-related operations. Since this vulnerability is a ReDoS issue, exploitation typically leaves no persistent file, registry, or malware indicator; correlate suspicious request bursts with process saturation and service degradation.

• npm ls diff
• diff@3.4.
• diff@3.3.
• diff@3.2.
• diff@3.1.
• diff@3.0.
• node_modules/diff/package.json
• package-lock.json
• yarn.lock
• pnpm-lock.yaml
• HTTP 408
• HTTP 429
• HTTP 499
• HTTP 500
• HTTP 502
• HTTP 503
• HTTP 504
• Event loop lag
• JavaScript heap out of memory
• CPU throttling
• OOMKilled
• CrashLoopBackOff

What your security team should do

• Inventory direct and transitive use of the diff npm package across source repositories, lockfiles, container images, and packaged applications.
• Prioritize upgrades for internet-facing services, monitoring platforms, CI/CD systems, and APIs that accept user-supplied text and may perform diff operations.
• Upgrade diff to 3.5.0 or later and Bitnami Grafana to 7.0.1 or later, then rebuild and redeploy affected artifacts.
• Add or verify request size limits, rate limits, and execution timeouts around text comparison, diff, import, or preview functionality.
• Monitor for CPU saturation, event-loop blocking, request timeouts, and repeated large or malformed requests to diff-related endpoints.
• Because this issue is not currently in CISA KEV and has no indicated public exploit maturity, treat it as a hygiene and resilience priority unless exposed functionality is internet-facing or business-critical.