CVE-2023-34109 Details

A vulnerability in zxcvbn-ts, an open-source password strength estimator written in TypeScript, allows for unbounded resource consumption in Node.js environments. This issue arises when the second argument of the zxcvbn function is used, leading to a memory leak as the user inputs array grows with each function call. While browsers can also be affected, the impact is more pronounced in Node.js, where the vulnerability can be exploited across all users of a platform, potentially crashing the process. The problem has been addressed in version 3.0.2. Users are advised to upgrade or, if unable to do so, to stop using the second argument of the zxcvbn function and instead use the zxcvbnOptions.setOptions function.

To address this vulnerability, users should upgrade to zxcvbn-ts version 3.0.2 or later. If an upgrade is not possible, users should discontinue the use of the second argument in the zxcvbn function and utilize the zxcvbnOptions.setOptions function instead.