Use After Free in Express with Basic Auth

In Express, Use After Free (UAF) occurs when memory that has been deallocated is still referenced and used, typically because asynchronous operations or callbacks retain references to objects that should have been released. When Basic Auth is used, the runtime may retain references to authorization headers, credential buffers, or parsed user objects across request lifecycles. If these references are kept in closures, event emitters, or long-lived caches after a request completes, and the underlying memory is subsequently freed or reused, a UAF condition can manifest. This is especially risky when middleware mutates or reuses objects that contain sensitive auth state.

Consider an Express route that parses Basic Auth credentials and attaches the resulting user object to req. If the route spawns asynchronous work (for example, a database query or a webhook call) and the request is closed or the user session is invalidated before the async work finishes, the user object may be freed while the async callback still references it. Subsequent reuse of that memory can lead to information disclosure or code execution. In the context of API scanning, middleBrick tests for authentication bypass and unsafe consumption patterns that can amplify UAF by allowing unauthenticated or elevated access to endpoints that depend on stale auth objects.

Real-world exploit patterns mirror known CVEs in native modules or poorly managed native bindings (e.g., issues in C++ addons or buffer handling in older Node.js versions). Although pure JavaScript UAF is rare due to garbage collection, interactions with native addons, external libraries, or improper session cleanup can reintroduce the class. The LLM/AI Security checks in middleBrick do not test for UAF directly, but the Authentication and Unsafe Consumption checks can surface misconfigurations that increase exposure: for example, unauthenticated endpoints that should require credentials, or endpoints that consume user-controlled input without proper validation, which may hint at flawed object lifetime management.

middleBrick scans the unauthenticated attack surface and can surface indicators such as missing authentication on sensitive routes, over-privileged endpoints, or inconsistent authorization checks that may coexist with UAF-like conditions. By correlating runtime findings with spec definitions (OpenAPI/Swagger with full $ref resolution), the scanner highlights endpoints where authentication is declared but not enforced or where authorization logic may leave dangling references. Remediation focuses on ensuring credentials and related objects are not retained beyond their intended scope and that async operations are tied to request lifecycle management.

To mitigate UAF and related memory-safety issues while using Basic Auth in Express, ensure credentials are parsed once per request, avoid retaining references after the response is sent, and clean up any async callbacks that might outlive the request. Below are concrete, working Express examples that demonstrate secure handling of Basic Auth.

First, a vulnerable pattern that risks retaining references:

// Risky: may retain references if async work outlives request
app.get('/profile', (req, res) => {
  const auth = parseBasicAuth(req.headers.authorization);
  if (!auth || !isValidUser(auth.user, auth.pass)) {
    return res.status(401).send('Unauthorized');
  }
  // Simulate async work that references auth after response
  db.getUserProfile(auth.user).then(profile => {
    // If request was closed, using res can cause issues; auth may be stale
    res.json(profile);
  });
});

Secure remediation using request-scoped cleanup and avoiding stale closures:

app.get('/profile', (req, res) => {
  const authHeader = req.headers.authorization;
  if (!authHeader) {
    return res.status(401).set('WWW-Authenticate', 'Basic').send('Auth required');
  }
  const auth = parseBasicAuth(authHeader);
  if (!auth || !isValidUser(auth.user, auth.pass)) {
    return res.status(401).set('WWW-Authenticate', 'Basic').send('Invalid credentials');
  }

  // Use a flag to ensure we do not write after response is finished
  let responded = false;
  const sendResponse = (data) => {
    if (!responded) {
      responded = true;
      res.json(data);
    }
  };

  db.getUserProfile(auth.user)
    .then(profile => sendResponse(profile))
    .catch(err => {
      if (!responded) {
        responded = true;
        res.status(500).send('Server error');
      }
    });

  // Explicit cleanup reference pattern (conceptual; JS GC handles most cases)
  req.on('close', () => {
    // No-op in pure JS, but signals intent to avoid using stale state in native addons
  });
});

For production, prefer a middleware that validates and attaches user info once, and ensure async routes check that the request is still active. If you use native modules or external libraries that allocate memory, follow their specific guidance for cleanup to reduce UAF risk. middleBrick’s Authentication and Unsafe Consumption checks can help identify endpoints where auth is missing or where input handling may interact poorly with object lifetime, supporting compliance mappings to OWASP API Top 10 and related frameworks.