GHSA-j8xg-fqg3-53r7

word-wrap vulnerable to Regular Expression Denial of Service

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-26115

Packages

Ecosystem	Package	Affected	Fixed in
npm	word-wrap	< 1.2.4	1.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-26115 advisory
https://github.com/jonschlinkert/word-wrap/commit/420dce9a2412b21881202b73a3c34f0edc53cb2e web
https://github.com/jonschlinkert/word-wrap package
https://github.com/jonschlinkert/word-wrap/blob/master/index.js#L39 web
https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39 web
https://github.com/jonschlinkert/word-wrap/releases/tag/1.2.4 web
https://security.netapp.com/advisory/ntap-20240621-0006 web
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657 web
https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973 web