GitHub Advisoryadvisory · npm

GHSA-333w-rxj3-f55r Regular Expression Denial Of Service in uri-js

MEDIUM Published 2018-07-24 Modified 2024-04-22 Official page ↗

Aliases: CVE-2017-16021
Ecosystem: npm
Packages: uri-js
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-1333, CWE-400
Reviewed: 2020-06-16

Affected packages

• npm uri-js: < 3.0.0 → fixed in 3.0.0

Description

Affected versions of `uri-js` is susceptible to a regular expression denial of service vulnerability when user input is sent to the `.parse()` method. Recommendation Update to v3.0.0 or later.

Alias · CVE (1)

CVE-2017-16021 uri-js is a module that tries to fully implement RFC 3986. vulnerability

Weakness · CWE (2)

CWE-1333 Inefficient Regular Expression Complexity weakness
CWE-400 Uncontrolled Resource Consumption weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2017-16021 advisory
https://github.com/garycourt/uri-js/issues/12 web
https://github.com/advisories/GHSA-333w-rxj3-f55r advisory
https://nodesecurity.io/advisories/100 web
https://www.npmjs.com/advisories/100 web