Applying a patch with a fuzzFactor can be very very slow
Maintainers usually reply within 1 day
@json-open-source is already working on this.
Since Oct 1, 2026.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- javascript
- Domain
- security
Research direction
Start at the applyPatch(...) and applyPatches(...) entrypoints and trace the fuzzy patch matching logic described in the report. Reproduce the control and crafted high-fuzzFactor cases to measure the slowdown. Done means crafted fuzzy patches no longer trigger excessive CPU time while normal fuzzy application behavior remains intact.
Written by the indexing model from the issue text.
Description
Thanks to the following five security researchers for reporting this:
- [email protected] (Ziyue), https://zyy0530.github.io/
- [email protected] (Chenchen), https://7thparkk.github.io/
- [email protected] (Strick), https://str1ckl4nd.github.io/
- [email protected] (Liyi), https://lzhou1110.github.io/
- [email protected] (Maurice), http://maurice.busystar.org/
Finding 1: Fuzzy patch application can cause algorithmic complexity DoS
Affected behavior
applyPatchandapplyPatchessupport fuzzy patch matching. With crafted hunks and a highfuzzFactor, the matching logic can end up exploring many alternatives recursively and spend a large amount of CPU time on a single input.Affected entrypoints
`applyPatch(...)` `applyPatches(...)`Reproduction notes
In our reproduction, a normal control case completed in under 1 ms, while a crafted fuzzy patch took about 7.7 seconds on the same setup:
control time: 0.568181 ms
exploit time: 7737.472789 ms
slowdown: 13617.9717xThe issue appears to come from recursive branch exploration in the fuzzy patch application logic.
- Dominant language
- JavaScript
- Stars
- 9.2k
- Forks
- 555
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 5
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from kpdecker/jsdiff
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
kpdecker/jsdiff#703 · 1 reaction ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 45/100
kpdecker/jsdiff#684 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
kpdecker/jsdiff#629 · 7 comments ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
kpdecker/jsdiff#624 · 6 comments ·
Maintainers usually reply within 1 day
Similar issues
-
channels:edit check:passed
Difficulty 1/5 Under an hour Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
lidofinance/docs#1033 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day