GHSA-xfhp-gmh8-r8v2
printf vulnerable to Regular Expression Denial of Service (ReDoS)
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string
```regex
/\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g
```
in `lib/printf.js`. The vulnerable regular expression has cubic worst-case time complexity.
References
External links from the advisory. They lead to third-party sites.