GitHub Advisoryadvisory · npm

GHSA-chw2-6c7r-37p7 uri-template-lite Regular Expression Denial of Service

MEDIUM Published 2022-08-25 Modified 2023-03-20 Official page ↗

Aliases: CVE-2021-43309
Ecosystem: npm
Packages: uri-template-lite
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-1333, CWE-697
Reviewed: 2022-09-01

Affected packages

• npm uri-template-lite: < 22.9.0 → fixed in 22.9.0

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method.

Alias · CVE (1)

CVE-2021-43309 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able… vulnerability

Weakness · CWE (2)

CWE-1333 Inefficient Regular Expression Complexity weakness
CWE-697 Incorrect Comparison weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2021-43309 advisory
https://github.com/litejs/uri-template-lite/commit/cbeec2b2a275d819fb534137a155df14729706f8 web
https://github.com/litejs/uri-template-lite package
https://github.com/litejs/uri-template-lite/commits/v22.9.0 web
https://research.jfrog.com/vulnerabilities/uri-template-lite-redos-xray-211351 web