GitHub Advisoryadvisory · npm

GHSA-7f53-fmmv-mfjv Regular expression denial of service in react-native

HIGH Published 2021-07-20 Modified 2021-06-10 Official page ↗
Aliases
CVE-2020-1920
Ecosystem
npm
Packages
react-native
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-697
Reviewed
2021-06-02

Affected packages

• npm react-native: >= 0.59.0, < 0.62.3 → fixed in 0.62.3 • npm react-native: >= 0.63.0, < 0.64.1 → fixed in 0.64.1

Description

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.

Related

Alias · CVE (1)

  • CVE-2020-1920 A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-697 Incorrect Comparison weakness

References