Out Of Bounds Read in Express with Basic Auth

An Out Of Bounds Read occurs when an application reads memory beyond the intended allocation, often returning adjacent data or causing crashes. In Express, this typically arises from unsafe handling of buffers, typed arrays, or string operations. When Basic Auth is used, credentials are transmitted in the Authorization header as a Base64-encoded string of username:password. If the server parses this value with an unsafe buffer operation—such as reading a fixed-size buffer without proper length checks—it may read past the allocated memory.

Consider a scenario where the server decodes the Basic Auth header into a fixed-size buffer to extract the username. An attacker can supply a long credential string that overflows the intended boundary, causing an out-of-bounds read. While this does not typically allow arbitrary code execution in managed runtime environments, it can expose sensitive process memory, including parts of the Authorization header itself, session tokens, or stack contents. In combination with Express routes that perform unsafe buffer slicing, this becomes a data exposure risk under the 12 security checks, categorized under Data Exposure and Input Validation.

For example, an unsafe route might decode the header and copy it into a small fixed-length buffer:

const auth = req.headers.authorization; // 'Basic dXNlcjpwYXNz'
if (auth && auth.startsWith('Basic ')) {
  const decoded = Buffer.from(auth.slice(6), 'base64');
  const buffer = Buffer.alloc(16);
  decoded.copy(buffer, 0, 0, 16); // Unsafe: no length validation
  const username = buffer.toString('utf8').split('\x00')[0];
}

If decoded exceeds 16 bytes, copy reads beyond the destination buffer, and the read may pull adjacent memory into username. This can leak credential fragments or internal data. Because this pattern does not trigger runtime exceptions in Node.js, the out-of-bounds read may go unnoticed while still exposing information. middleBrick detects such unsafe buffer handling during its Input Validation and Data Exposure checks, identifying risky patterns in the runtime behavior of unauthenticated endpoints.

Another vector involves parsing header values into fixed-size arrays or using unsafe iteration over buffers. For instance, iterating with a hardcoded loop length instead of the actual buffer length can read unintended memory:

const raw = req.headers.authorization?.slice(6);
const data = raw ? Buffer.from(raw, 'base64') : Buffer.alloc(0);
const safe = Buffer.alloc(32);
for (let i = 0; i < 32; i++) {
  safe[i] = data[i]; // Out-of-bounds read when data.length < 32
}

Out-of-bounds reads here depend on the attacker-controlled length of the credential. middleBrick’s unauthenticated scan can surface these patterns by correlating OpenAPI/Swagger definitions with runtime behavior, flagging endpoints where Basic Auth is processed without proper input validation.

Remediation focuses on validating lengths before copying data and avoiding fixed-size buffers when handling dynamic credential values. Always derive buffer sizes from the actual input length and avoid copying a header value into a pre-allocated fixed buffer.

Safe approach using dynamic buffers:

const auth = req.headers.authorization; // 'Basic dXNlcjpwYXNz'
if (auth && auth.startsWith('Basic ')) {
  const decoded = Buffer.from(auth.slice(6), 'base64');
  // Work with decoded directly; no fixed-size copy
  const parts = decoded.toString('utf8').split(':');
  const username = parts[0];
  const password = parts[1];
  // Validate length and content as needed
  if (username.length > 0 && password.length > 0) {
    // Proceed with authentication
  }
}

If you must use a fixed-size target, explicitly limit the copy length to the smaller of source and destination sizes:

const auth = req.headers.authorization;
if (auth && auth.startsWith('Basic ')) {
  const decoded = Buffer.from(auth.slice(6), 'base64');
  const targetSize = 16;
  const safe = Buffer.alloc(targetSize);
  const bytesToCopy = Math.min(decoded.length, targetSize);
  decoded.copy(safe, 0, 0, bytesToCopy);
  // Zero out remaining bytes if necessary
  if (bytesToCopy < targetSize) {
    safe.fill(0, bytesToCopy, targetSize);
  }
  const username = safe.toString('utf8').split('\x00')[0];
}

Additionally, prefer standard authentication middleware such as express-basic-auth or custom verification that does not rely on manual buffer manipulation:

const basicAuth = require('express-basic-auth');
app.use(basicAuth({
  users: { 'admin': 'secret' },
  challenge: true,
}));

By avoiding unsafe fixed-size buffer copies and relying on well-maintained libraries, you reduce the risk of out-of-bounds reads and related data exposure. middleBrick’s Pro plan supports continuous monitoring and can flag regressions in authentication handling as part of its GitHub Action integration, helping you fail builds if insecure patterns reappear.