Security Issue: ReDOS-Attack Vector in Dicer dependency

[Uzlopak]

tl;dr;
An attacker could send a payload with large headers, which contain no colon, repeatedly, resulting in a REDoS-Attack.

The Regex for handling headerpairs is prone to catastrophic backtracking.

This is even more critical, as busboys default limit for multipart headers is 80kby and that if a header is not valid, the counter for headers is not increasing. Meaning, that the attacker could send a big payload of multipart formdata, were each multipart contains 80kby of invalid headerdata resulting in a DoS-Attack.

We are gonna fix this in our fork:
fastify/busboy#72

[mscdex]

The proper avenue for such reports for any of my repositories is an email to: security at mscdex.net.