Pug Template Engine Denial of Service Vulnerability

CVE-2019-8331 CVSS 5.7 Denial of Service

Description

Pug before version 2.0.4 is vulnerable to Denial of Service attacks when a crafted template is rendered. Specifically, crafted input can cause an exponential execution time via the compiled template.

Pug (formerly known as Jade) is a high-performance template engine heavily influenced by Haml and implemented with JavaScript for Node.js and browsers.

Demonstration

Test the Pug Denial of Service vulnerability by providing a template string to render:

DoS Payload Example:

// This malicious template causes exponential rendering time
- var x = "x";
- for (var i = 0; i < 10; i++)
  - x = x + x + x + x + x + x + x + x + x + x
p= x

⚠️ Warning: Using the payload above may cause the browser to hang or crash. Use with caution.

Mitigation

To mitigate this vulnerability:

  • Update to Pug version 2.0.4 or higher
  • Implement template size limits and timeout mechanisms
  • Avoid rendering untrusted user-supplied templates
  • Use a template sandbox to isolate potentially dangerous template execution
// Update command:
npm update pug --save

// Or pin to a specific safe version:
npm install pug@3.0.2 --save

References