GitHub Advisoryadvisory · npm

GHSA-vx3p-948g-6vhq Regular Expression Denial of Service (ReDoS)

HIGH Published 2021-03-19 Modified 2021-10-21 Official page ↗
Aliases
CVE-2021-27290
Ecosystem
npm
Packages
ssri
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-03-15

Affected packages

• npm ssri: >= 5.2.2, < 6.0.2 → fixed in 6.0.2 • npm ssri: >= 7.0.0, < 7.1.1 → fixed in 7.1.1 • npm ssri: >= 8.0.0, < 8.0.1 → fixed in 8.0.1

Description

npm `ssri` 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

Related

Alias · CVE (1)

  • CVE-2021-27290 ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References