GitHub Advisoryadvisory · npm

GHSA-q5c4-39f5-m68j Regular Expression Denial of Service in decamelize

HIGH Published 2018-07-24 Modified 2023-09-08 Official page ↗
Aliases
CVE-2017-16023
Ecosystem
npm
Packages
decamelize
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm decamelize: >= 1.1.0, < 1.1.2 → fixed in 1.1.2

Description

Affected versions of `decamelize` are susceptible to a denial of service vulnerability when user input is passed directly into `decamelize`. Recommendation Update to version 1.1.2 or later.

Related

Alias · CVE (1)

  • CVE-2017-16023 Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References