GHSA-xrx9-gj26-5wx9

    Dashboard / Vulnerabilities / GHSA-xrx9-gj26-5wx9

    GHSA-xrx9-gj26-5wx9

    Published: 7 Oct 2022Last Modified: 8 Nov 2023

    Summary: v8n vulnerable to Inefficient Regular Expression Complexity

    Details: ### Impact Inefficient regular expression complexity of `lowercase()` and `uppercase()` regex could lead to a denial of service attack. With a formed payload `'a' + 'a'.repeat(i) + 'A'`, only 32 characters payload could take 29443 ms time execution when testing `lowercase()`. The same issue happens with `uppercase()`. ### Patches v1.5.1 ### References [huntr.dev report](https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609) [_Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking_](https://snyk.io/blog/redos-and-catastrophic-backtracking/) ### For more information If you have any questions or comments about this advisory: * Open an issue in [v8n issues list](https://github.com/imbrn/v8n) * Email us at [[email protected]](mailto:[email protected])

    References: https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9, https://nvd.nist.gov/vuln/detail/CVE-2022-35923, https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9, https://github.com/imbrn/v8n, https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609

    Affected packages

    Package

    Name: v8n

    Purl: pkg:npm/v8n

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.5.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-xrx9-gj26-5wx9 | CVE-DB