GHSA-pfq8-rq6v-vf5m
kangax html-minifier REDoS vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | html-minifier | <= 4.0.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-37620
- https://github.com/kangax/html-minifier/issues/1135
- https://github.com/kangax/html-minifier
- https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L1338
- https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L294
- https://security.snyk.io/vuln/SNYK-JS-HTMLMINIFIER-3091181