GitHub Advisoryadvisory · npm

GHSA-q75g-2496-mxpp Regular Expression Denial of Service in parsejson

HIGH Published 2018-07-24 Modified 2020-08-31 Official page ↗
Aliases
CVE-2017-16113
Ecosystem
npm
Packages
parsejson
Severity
High
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm parsejson: <= 0.0.3 (no fix yet)

Description

Affected versions of `parsejson` are vulnerable to a regular expression denial of service when parsing untrusted user input. Recommendation The `parsejson` package has not been functionally updated since it was initially released. Additionally, it provides functionality which is natively included in Node.js, and therefore the native `JSON.parse()` should be used, for both performance and security reasons.

Related

Alias · CVE (1)

  • CVE-2017-16113 The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References