GitHub Advisoryadvisory · npm

GHSA-832h-xg76-4gv6 ReDoS in brace-expansion

HIGH Published 2018-01-29 Modified 2021-09-03 Official page ↗
Aliases
CVE-2017-18077
Ecosystem
npm
Packages
brace-expansion
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2020-06-16

Affected packages

• npm brace-expansion: < 1.1.7 → fixed in 1.1.7

Description

Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition. Proof of Concept ``` var expand = require('brace-expansion'); expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}'); ``` Recommendation Update to version 1.1.7 or later.

Related

Alias · CVE (1)

  • CVE-2017-18077 index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References