~ / search / GHSA-vx3p-948g-6vhq

GHSA-vx3p-948g-6vhq

Regular Expression Denial of Service (ReDoS)

Source: GitHub Advisory Database (reviewed) High CVE-2021-27290

Packages

EcosystemPackageAffectedFixed in
npm ssri >= 5.2.2, < 6.0.2 6.0.2
npm ssri >= 7.0.0, < 7.1.1 7.1.1
npm ssri >= 8.0.0, < 8.0.1 8.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

npm `ssri` 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

References

External links from the advisory. They lead to third-party sites.