GitHub Advisoryadvisory · npm

GHSA-fp36-299x-pwmw Regular expression denial of service in devcert

HIGH Published 2022-06-03 Modified 2022-06-14 Official page ↗
Aliases
CVE-2022-1929
Ecosystem
npm
Packages
devcert
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2022-06-03

Affected packages

• npm devcert: < 1.2.1 → fixed in 1.2.1

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

Related

Alias · CVE (1)

  • CVE-2022-1929 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References