GitHub Advisoryadvisory · npm

GHSA-jxqq-cqm6-pfq9 Regular Expression Denial of Service in slug

MEDIUM Published 2018-07-24 Modified 2020-08-31 Official page ↗
Aliases
CVE-2017-16117
Ecosystem
npm
Packages
slug
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm slug: < 0.9.2 → fixed in 0.9.2

Description

Affected versions of `slug` are vulnerable to a regular expression denial of service when parsing untrusted user input. The issue is low severity, as it takes 50,000 characters to cause the event loop to block for 2 seconds, About 50k characters can block the event loop for 2 seconds. Recommendation Update to version 0.9.2 or later.

Related

Alias · CVE (1)

  • CVE-2017-16117 slug is a module to slugify strings, even if they contain unicode. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References