GitHub Advisoryadvisory · npm

GHSA-pp4v-55vr-9gxh Regular Expression Denial of Service in riot-compiler

HIGH Published 2019-02-18 Modified 2023-09-12 Official page ↗
Aliases
CVE-2016-10527
Ecosystem
npm
Packages
riot-compiler
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm riot-compiler: < 2.3.22 → fixed in 2.3.22

Description

Affected versions of `riot-compiler` are susceptible to a regular expression denial of service vulnerability. Recommendation Update to version 2.3.22 or later.

Related

Alias · CVE (1)

  • CVE-2016-10527 The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References