GitHub Advisoryadvisory · npm

GHSA-v2p6-4mp7-3r9v Regular Expression Denial of Service in underscore.string

MEDIUM Published 2019-06-14 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
underscore.string
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2019-06-14

Affected packages

• npm underscore.string: < 3.3.5 → fixed in 3.3.5

Description

Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS). The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs. Recommendation Upgrade to version 3.3.5 or higher.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References