GitHub Advisoryadvisory · npm, Maven

GHSA-89w7-5q45-r53w lite-server vulnerable to Denial of Service

HIGH Published 2022-12-20 Modified 2025-04-16 Official page ↗
Aliases
CVE-2022-25940
Ecosystem
npm, Maven
Packages
lite-server, org.webjars.npm:lite-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-400
Reviewed
2022-12-20

Affected packages

• npm lite-server: <= 2.6.1 (no fix yet) • Maven org.webjars.npm:lite-server: <= 2.2.0 (no fix yet)

Description

All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the `decodeURI()` function is unable to parse.

Related

Alias · CVE (1)

  • CVE-2022-25940 All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References