GitHub Advisoryadvisory · npm

GHSA-xrx9-gj26-5wx9 v8n vulnerable to Inefficient Regular Expression Complexity

HIGH Published 2022-10-07 Modified 2022-10-07 Official page ↗
Aliases
CVE-2022-35923
Ecosystem
npm
Packages
v8n
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400
Reviewed
2022-10-07

Affected packages

• npm v8n: < 1.5.1 → fixed in 1.5.1

Description

Impact Inefficient regular expression complexity of `lowercase()` and `uppercase()` regex could lead to a denial of service attack. With a formed payload `'a' + 'a'.repeat(i) + 'A'`, only 32 characters payload could take 29443 ms time execution when testing `lowercase()`. The same issue happens with `uppercase()`. Patches v1.5.1 References huntr.dev report _Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking_ For more information If you have any questions or comments about this advisory: • Open an issue in v8n issues list • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-35923 v8n is a javascript validation library. vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References