CVE-2023-30858

    Dashboard / Vulnerabilities / CVE-2023-30858

    CVE-2023-30858

    Published: 28 Apr 2023Last Modified: 12 Aug 2026

    Summary: Denosaurs emoji has ReDoS vulnerability in `replace` function

    Details: The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. The issue has been patched in 0.3.0. As a workaround, avoid using the `replace`, `unemojify`, or `strip` functions.

    References: https://huntr.dev/bounties/444f2255-5085-466f-ba0e-5549fa8846a3/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30858.json, https://github.com/denosaurs/emoji/security/advisories/GHSA-w2xx-hjhp-gx5v, https://nvd.nist.gov/vuln/detail/CVE-2023-30858, https://github.com/denosaurs/emoji/pull/11

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 80d8525298b86396a268e065f5584f91d31c4f03
    Fixed -a61ec134727eb9c7ede85ebad89e0d20074ead7c

    Affected versions

    0.2.1
    0.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-30858 | CVE-DB