Security readout for executives and security teams
Plain-English summary
A maliciously shaped HTTP Link header can make parse-link-header spend excessive CPU time parsing it, potentially slowing or taking down services. The supplied sources describe an availability impact only, not data theft or code execution.
Executive priority
Treat as a focused availability risk. Prioritize internet-facing services and integrations that consume external APIs, because a simple unauthenticated input may cause service disruption.
Technical view
CVE-2021-23490 is a Regular Expression Denial of Service issue in parse-link-header before 2.0.0, specifically via the checkHeader function. CVSS 3.1 is 7.5: network reachable, low complexity, no privileges, no user interaction, high availability impact.
Likely exposure
Exposure is most likely in Node.js or WebJars-packaged applications that use parse-link-header before 2.0.0 on attacker-controlled or upstream-supplied Link headers.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. Practical risk depends on whether untrusted Link headers reach the vulnerable parser.
Researcher notes
Evidence is limited to package advisories and the fixing commit. The source bundle names checkHeader but does not include exploit evidence, affected CPEs, or detailed product-specific deployment conditions.
Mitigation direction
- Upgrade parse-link-header to version 2.0.0 or later where applicable.
- Check WebJars/NPM transitive dependencies for vulnerable packaged versions.
- Limit or reject unusually large or malformed Link headers before parsing.
- Monitor vendor advisories if direct upgrade is blocked.
Validation and detection
- Search dependency manifests and lockfiles for parse-link-header versions before 2.0.0.
- Check SBOM or SCA output for SNYK-JS-PARSELINKHEADER-1582783.
- Identify routes or jobs parsing external HTTP Link headers.
- Confirm deployed artifacts no longer include vulnerable dependency versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-23490 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://snyk.io/vuln/SNYK-JS-PARSELINKHEADER-1582783CVE reference · x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2321973CVE reference · x_refsource_MISC
- https://github.com/thlorenz/parse-link-header/commit/72f05c717b3f129c5331a07bf300ed8886eb8ae1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.