Heap Overflow in Feathersjs with Dynamodb

A heap overflow in a FeathersJS application using DynamoDB typically arises when untrusted input directly controls memory allocation or deserialization behavior upstream of the DynamoDB interaction. Although DynamoDB itself does not expose a heap overflow surface (it is a managed service), the client code that builds requests and processes responses can be vulnerable. In FeathersJS, services often accept payloads that are merged into parameters for DynamoDB operations such as put or update. If these payloads are large, deeply nested, or contain attacker-controlled numeric fields that affect batch sizes or internal buffers, they may trigger excessive memory allocation during request building or response parsing.

Consider a FeathersJS service that forwards a user-supplied object to DynamoDB via the AWS SDK. The SDK constructs HTTP requests and buffers payloads; if the payload contains very large attribute values or an unexpectedly high number of items (e.g., in BatchWriteItem), the Node.js process may allocate large contiguous buffers. An attacker can craft input that causes oversized allocations, leading to heap exhaustion in the runtime. This is not a DynamoDB vulnerability but a client-side issue where FeathersJS does not validate or bound input before it reaches the AWS SDK.

Additionally, DynamoDB’s response handling can contribute to risk. If a query returns a large item or a scan returns many items, FeathersJS may materialize the entire response in memory before further processing. Combined with unvalidated input that influences Limit or pagination tokens, this can cause memory growth proportional to attacker-influenced parameters. Common patterns include missing pagination controls, unbounded Limit values, or deeply nested attribute structures that increase serialization/deserialization overhead. Real-world vectors such as malformed request streams or oversized JSON payloads mirror findings seen in broader API security assessments reported as issues like CVE-2023-30861 (Node.js HTTP parser) when client libraries are improperly constrained.

In the context of the middleBrick scanner, these issues are surfaced under the Input Validation and Unsafe Consumption checks, alongside BFLA/Privilege Escalation and Property Authorization, because unbounded or untrusted data can lead to exposure of sensitive fields or privilege bypass if DynamoDB operations are misconfigured. The LLM/AI Security checks are relevant if an AI coding assistant suggests permissive patterns that omit size or type checks for DynamoDB payloads. middleBrick’s cross-referencing of OpenAPI specs with runtime findings helps identify mismatches between declared schemas and actual behavior, highlighting where input validation should be tightened before data reaches DynamoDB.

Remediation focuses on bounding input, validating sizes, and constraining DynamoDB operations within FeathersJS services. Use explicit validation for payload size and structure before invoking the AWS SDK, and avoid passing raw user input directly to DynamoDB operations.

Example 1: Bounded create with validation

Ensure incoming data size and shape are controlled. Use a schema-aware validator and limit attribute sizes before creating DynamoDB items.

const { Validator } = require('fastest-validator');
const v = new Validator();
const schema = {
  id: 'string',
  name: { type: 'string', maxLength: 100 },
  tags: { type: 'array', items: { type: 'string', maxLength: 50 }, maxLength: 10 },
  metadata: { type: 'object', maxKeys: 20 }
};

app.service('items').hooks({
  before: {
    create: [context => {
      const valid = v.validate(context.data, schema);
      if (valid !== true) {
        throw new Error('Invalid payload: ' + JSON.stringify(valid));
      }
      // Optionally truncate or reject oversized fields
      return context;
    }]
  }
});

// DynamoDB write with controlled item size
const AWS = require('aws-sdk');
const dynamo = new AWS.DynamoDB.DocumentClient();

app.service('items').hooks({
  after: {
    create: [async context => {
      const params = {
        TableName: process.env.DYNAMO_TABLE,
        Item: context.result
      };
      await dynamo.put(params).promise();
      return context;
    }]
  }
});

Example 2: Safe query with Limit and pagination controls

Prevent unbounded reads by enforcing a maximum limit and validating pagination tokens. This reduces the chance of excessive memory allocation from large responses.

const MAX_LIMIT = 50;

app.service('search').hooks({
  before: {
    find: context => {
      const incomingLimit = context.params.query.limit;
      const safeLimit = typeof incomingLimit === 'number' && incomingLimit > 0 && incomingLimit <= MAX_LIMIT
        ? incomingLimit
        : 20;
      context.params.query.limit = safeLimit;
      // Ensure exclusive start key is a string if provided
      if (context.params.query.exclusiveStartKey && typeof context.params.query.exclusiveStartKey !== 'string') {
        delete context.params.query.exclusiveStartKey;
      }
      return context;
    }
  },
  after: {
    find: async context => {
      const params = {
        TableName: process.env.DYNAMO_TABLE,
        Limit: context.params.query.limit
      };
      if (context.params.query.exclusiveStartKey) {
        params.ExclusiveStartKey = context.params.query.exclusiveStartKey;
      }
      const data = await dynamo.scan(params).promise();
      context.result = data.Items || [];
      return context;
    }
  }
});

Example 3: BatchWriteItem with item size checks

When using batch operations, validate each item and cap batch size to avoid oversized requests that stress the client’s heap.

const MAX_BATCH_ITEMS = 25; // DynamoDB allows up to 25 items per BatchWriteItem

app.service('batch').hooks({
  before: {
    create: context => {
      const items = context.data.items || [];
      if (!Array.isArray(items) || items.length === 0 || items.length > MAX_BATCH_ITEMS) {
        throw new Error('Invalid batch size');
      }
      // Validate each item
      const validator = new Validator();
      const validItems = items.filter(item => validator.validate(item, schema) === true);
      if (validItems.length !== items.length) {
        throw new Error('Some batch items failed validation');
      }
      context.params.body.RequestItems = {
        [process.env.DYNAMO_TABLE]: items.map(item => ({ PutRequest: { Item: item } }))
      };
      return context;
    }
  },
  after: {
    create: async context => {
      const params = {
        RequestItems: context.params.body.RequestItems
      };
      await dynamo.batchWrite(params).promise();
      return context;
    }
  }
});

These patterns align with the remediation guidance provided in the middleBrick reports under the BFLA/Privilege Escalation and Property Authorization checks: ensure DynamoDB operations are scoped and bounded by validated input. By combining schema validation, size limits, and controlled pagination, you reduce the attack surface that could otherwise lead to heap-related instability in the Node.js runtime when interacting with DynamoDB through FeathersJS.