~ / search / GHSA-xrx9-gj26-5wx9

GHSA-xrx9-gj26-5wx9

v8n vulnerable to Inefficient Regular Expression Complexity

Source: GitHub Advisory Database (reviewed) High CVE-2022-35923

Packages

EcosystemPackageAffectedFixed in
npm v8n < 1.5.1 1.5.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Inefficient regular expression complexity of `lowercase()` and `uppercase()` regex could lead to a denial of service attack. With a formed payload `'a' + 'a'.repeat(i) + 'A'`, only 32 characters payload could take 29443 ms time execution when testing `lowercase()`. The same issue happens with `uppercase()`. ### Patches v1.5.1 ### References [huntr.dev report](https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609) [_Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking_](https://snyk.io/blog/redos-and-catastrophic-backtracking/) ### For more information If you have any questions or comments about this advisory: * Open an issue in [v8n issues list](https://github.com/imbrn/v8n) * Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.