Double Free in Express with Basic Auth

A Double Free occurs when an application attempts to free the same memory block more than once. In the Express.js context combined with Basic Authentication, this typically arises from how authorization headers are parsed, cached, or released across asynchronous operations. Basic Auth credentials are decoded on every request; if the parsing logic or a downstream library allocates and then erroneously deallocates the same buffer—especially under concurrent or pipelined requests—a Double Free can be triggered.

Consider an Express app that decodes Basic Auth and attaches a user object to req. If the decoding step caches credentials in a shared structure (for example, a Map keyed by the base64 token) and both the cache cleanup and the per-request object disposal routines run for the same request, a double-free condition may emerge. This is exacerbated when middleware and route handlers are not careful about reference ownership. An attacker can induce repeated or malformed requests that trigger the condition, potentially leading to undefined behavior, crashes, or memory corruption that may be exploitable in certain environments.

Because middleBrick scans the unauthenticated attack surface, it can detect indicators such as missing validation on the Authorization header and unusual patterns around credential handling. For example, a scan might flag missing input validation on the Authorization header as a related finding, since malformed credentials can increase the likelihood of memory-handling bugs. The LLM/AI Security checks also probe for system prompt leakage and injection, which, while not directly causing Double Free, highlight how unchecked inputs near sensitive control structures can amplify risk.

Real-world parallels include CVE-2022-24999 in other ecosystems, where malformed header handling led to memory issues. Although middleBrick does not perform source code analysis, its inventory and runtime checks help surface inconsistent authentication and authorization flows that could set the stage for such classes of vulnerabilities.

To mitigate Double Free and related memory-safety issues when using Basic Auth in Express, focus on deterministic resource handling, strict input validation, and avoiding shared mutable state for request-specific credentials. Ensure that any buffers, objects, or cached entries are owned by a single scope and released exactly once.

Use a robust parsing approach for the Authorization header and validate credentials before attaching them to the request. Below is a concrete, safe Express example that decodes Basic Auth, validates inputs, and avoids shared caches that could contribute to double-free-like conditions in native addons or poorly managed caches:

const express = require('express');
const app = express();

// Middleware to parse and validate Basic Auth safely
app.use((req, res, next) => {
  const authHeader = req.headers['authorization'];
  if (!authHeader || !authHeader.startsWith('Basic ')) {
    return res.status(401).json({ error: 'Missing or invalid Authorization header' });
  }
  const base64 = authHeader.split(' ')[1];
  if (typeof base64 !== 'string') {
    return res.status(400).json({ error: 'Malformed Authorization header' });
  }
  let decoded;
  try {
    decoded = Buffer.from(base64, 'base64').toString('utf-8');
  } catch (err) {
    return res.status(400).json({ error: 'Invalid credentials encoding' });
  }
  const parts = decoded.split(':');
  if (parts.length !== 2 || !parts[0] || !parts[1]) {
    return res.status(400).json({ error: 'Invalid credentials format' });
  }
  const [username, password] = parts;
  // Perform your authentication/authorization check here
  // Avoid storing shared state keyed by raw credentials
  req.user = { username };
  next();
});

app.get('/secure', (req, res) => {
  res.json({ message: `Authenticated as ${req.user.username}` });
});

app.listen(3000, () => console.log('Server running on port 3000'));

Key practices reflected in this example:

• Validate the presence and format of the Authorization header before any decoding.
• Use Buffer.from(..., 'base64') inside a try-catch to handle malformed base64 safely.
• Avoid caching decoded credentials in a shared map; if caching is required, use request-scoped caches with clear lifecycle management.
• Keep sensitive data out of global or long-lived structures; prefer short-lived variables that are released when the request ends.

For production, pair this with strong transport security (HTTPS) and consider using higher-level authentication mechanisms (e.g., sessions or tokens) to reduce the surface area for malformed header handling. middleBrick’s CLI can verify that your endpoints enforce authentication and input validation, while the GitHub Action can ensure these checks are part of your CI/CD pipeline.