GitHub Advisoryadvisory · npm

GHSA-ff6r-5jwm-8292 Regular Expression Denial of Service in no-case

HIGH Published 2018-07-24 Modified 2023-09-11 Official page ↗
Aliases
CVE-2017-16099
Ecosystem
npm
Packages
no-case
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm no-case: < 2.3.2 → fixed in 2.3.2

Description

Affected versions of `no-case` are vulnerable to a regular expression denial of service when parsing untrusted user input. Recommendation Update to version 2.3.2 or later.

Related

Alias · CVE (1)

  • CVE-2017-16099 The no-case module is vulnerable to regular expression denial of service. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References