GitHub Advisoryadvisory · npm
GHSA-vqc4-v8hc-h2jg Polynomial regular expression used on uncontrolled data in nitrado.js
HIGH
Official page ↗
- Aliases
- CVE-2022-36034
- Ecosystem
- npm
- Packages
- nitrado.js
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2022-08-31
Affected packages
• npm nitrado.js: < 0.2.5 → fixed in 0.2.5
Description
Impact
Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`
Patches
Patched in all versions above `0.2.5`
Workarounds
No known work arounds.
References
• OWASP: Regular expression Denial of Service - ReDoS
• Wikipedia: ReDoS.
• Wikipedia: Time complexity.
• James Kirrage, Asiri Rathnayake, Hayo Thielecke: Static Analysis for Regular Expression Denial-of-Service Attack.
• Common Weakness Enumeration: CWE-1333.
• Common Weakness Enumeration: CWE-400.
Related
Alias · CVE (1)
- CVE-2022-36034 nitrado.js is a type safe wrapper for the Nitrado API. vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness