GitHub Advisoryadvisory · npm

GHSA-g36h-6r4f-3mqp Regular Expression Denial of Service in string package

HIGH Published 2018-07-24 Modified 2023-09-12 Official page ↗
Aliases
CVE-2017-16116
Ecosystem
npm
Packages
string
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm string: <= 3.3.3 (no fix yet)

Description

Affected versions of `string` are vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the `underscore` or `unescapeHTML` methods. Recommendation There is currently no direct patch for this vulnerability. Currently, the best solution is to avoid passing user input to the `underscore` and `unescapeHTML` methods. Alternatively, a user provided patch is available in Pull Request #217, however this patch has not been tested, nor has it been merged by the package author.

Related

Alias · CVE (1)

  • CVE-2017-16116 The string module is a module that provides extra string operations. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References