Headline
GHSA-vqc4-v8hc-h2jg: Polynomial regular expression used on uncontrolled data in nitrado.js
Impact
Possible ReDoS with lib input of {{ and with many repetitions of {{|.
Patches
Patched in all versions above 0.2.5
Workarounds
No known work arounds.
References
- OWASP: Regular expression Denial of Service - ReDoS
- Wikipedia: ReDoS.
- Wikipedia: Time complexity.
- James Kirrage, Asiri Rathnayake, Hayo Thielecke: Static Analysis for Regular Expression Denial-of-Service Attack.
- Common Weakness Enumeration: CWE-1333.
- Common Weakness Enumeration: CWE-400.
Polynomial regular expression used on uncontrolled data in nitrado.js
High severity GitHub Reviewed Published Aug 31, 2022 in cainthebest/nitrado.js • Updated Aug 31, 2022
Related news
CVE-2022-36034: nitrado.js/CHANGELOG.md at v0.2.5 · cainthebest/nitrado.js
nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in all versions above `0.2.5`. There are currently no known workarounds.