GHSA-pmvv-57rg-5g86

CommonRegexJS Regular Expression Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-26305

Packages

Ecosystem	Package	Affected	Fixed in
npm	commonregex	<= 0.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-26305 advisory
https://github.com/talyssonoc/CommonRegexJS/issues/4 web
https://github.com/talyssonoc/CommonRegexJS package
https://securitylab.github.com/advisories/GHSL-2020-291-redos-CommonRegexJS advisory