CVE-2021-23490: 
JavaScript vulnerability analysis and mitigation

The parse-link-header package versions before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function. This vulnerability was disclosed on December 19, 2021, and is tracked as CVE-2021-23490 (Snyk).

The vulnerability exists in the checkHeader function where malicious input can cause catastrophic backtracking in the regular expression engine. When processing certain patterns, the number of backtracking steps can grow exponentially with input size, leading to excessive CPU consumption. For example, with a specially crafted input containing repetitive patterns, the processing time can increase dramatically (Snyk).

When successfully exploited, this vulnerability can result in a Denial of Service condition. The attack can cause the service to excessively consume CPU resources, leading to a total loss of availability while the attack is ongoing. This impact is particularly severe as it can be triggered without any special privileges or user interaction (Snyk).

The recommended mitigation is to upgrade parse-link-header to version 2.0.0 or higher. The fix implements input length limitations and adds a checkHeader function to prevent ReDoS attacks (GitHub Commit).