GitHub Advisoryadvisory · npm

GHSA-62gr-4qp9-h98f Regular Expression Denial of Service in Handlebars

HIGH Published 2022-02-10 Modified 2021-04-22 Official page ↗
Aliases
CVE-2019-20922
Ecosystem
npm
Packages
handlebars
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-04-22

Affected packages

• npm handlebars: >= 4.0.0, < 4.4.5 → fixed in 4.4.5

Description

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

Related

Alias · CVE (1)

  • CVE-2019-20922 Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References