GitHub Advisoryadvisory · npm

GHSA-jgrx-mgxx-jf9v tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion

HIGH Published 2021-09-20 Modified 2022-08-10 Official page ↗

Aliases: CVE-2021-3777
Ecosystem: npm
Packages: tmpl
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-400
Reviewed: 2021-09-16

Affected packages

• npm tmpl: < 1.0.5 → fixed in 1.0.5

Description

nodejs-tmpl is simple string formatting. tmpl is vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion.

Related

Alias · CVE (1)

CVE-2021-3777 nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity vulnerability

Weakness · CWE (1)

CWE-400 Uncontrolled Resource Consumption weakness

References