GHSA-xrx9-gj26-5wx9
v8n vulnerable to Inefficient Regular Expression Complexity
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Inefficient regular expression complexity of `lowercase()` and `uppercase()` regex could lead to a denial of service attack. With a formed payload `'a' + 'a'.repeat(i) + 'A'`, only 32 characters payload could take 29443 ms time execution when testing `lowercase()`. The same issue happens with `uppercase()`.
### Patches
v1.5.1
### References
[huntr.dev report](https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609)
[_Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking_](https://snyk.io/blog/redos-and-catastrophic-backtracking/)
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [v8n issues list](https://github.com/imbrn/v8n)
* Email us at [[email protected]](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.