GitHub Advisoryadvisory · npm

GHSA-qx4v-6gc5-f2vv Regular Expression Denial of Service

MEDIUM Published 2019-06-20 Modified 2021-02-25 Official page ↗
Ecosystem
npm
Packages
esm
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2019-06-20

Affected packages

• npm esm: < 3.1.0 → fixed in 3.1.0

Description

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References