GitHub Advisoryadvisory · npm
GHSA-xmc8-cjfr-phx3 Regular Expression Denial of Service in highcharts
HIGH
Official page ↗
- Aliases
- CVE-2018-20801
- Ecosystem
- npm
- Packages
- highcharts
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2020-06-16
Affected packages
• npm highcharts: < 6.1.0 → fixed in 6.1.0
Description
Versions of `highcharts` prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.
Recommendation
Upgrade to version 6.1.0 or higher.
Related
Alias · CVE (1)
- CVE-2018-20801 In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a… vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-20801 advisory
- https://github.com/highcharts/highcharts/commit/7c547e1e0f5e4379f94396efd559a566668c0dfa web
- https://github.com/advisories/GHSA-xmc8-cjfr-phx3 advisory
- https://github.com/highcharts/highcharts package
- https://security.netapp.com/advisory/ntap-20190715-0001 web
- https://snyk.io/vuln/npm:highcharts:20180225 web
- https://www.npmjs.com/advisories/793 web