GitHub Advisoryadvisory · npm
GHSA-jxqq-cqm6-pfq9 Regular Expression Denial of Service in slug
MEDIUM
Official page ↗
- Aliases
- CVE-2017-16117
- Ecosystem
- npm
- Packages
- slug
- Severity
- Moderate
- Weaknesses
- CWE-400
- Reviewed
- 2020-06-16
Affected packages
• npm slug: < 0.9.2 → fixed in 0.9.2
Description
Affected versions of `slug` are vulnerable to a regular expression denial of service when parsing untrusted user input.
The issue is low severity, as it takes 50,000 characters to cause the event loop to block for 2 seconds,
About 50k characters can block the event loop for 2 seconds.
Recommendation
Update to version 0.9.2 or later.
Related
Alias · CVE (1)
- CVE-2017-16117 slug is a module to slugify strings, even if they contain unicode. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness