GitHub Advisoryadvisory · npm

GHSA-pvrw-g6fx-mcx2 is_js vulnerable to Regular Expression Denial of Service

HIGH Published 2023-07-06 Modified 2023-07-06 Official page ↗
Aliases
CVE-2020-26302
Ecosystem
npm
Packages
is_js
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400
Reviewed
2023-07-06

Affected packages

• npm is_js: <= 0.9.0 (no fix yet)

Description

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to loop "forever." This vulnerability was found using a CodeQL query which identifies inefficient regular expressions. is.js has no patch for this issue.

Related

Alias · CVE (1)

  • CVE-2020-26302 is.js is a general-purpose check library. vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References