imbrn/v8n · Security
v8n vulnerable to Inefficient Regular Expression Complexity
- GHSA ID
- GHSA-xrx9-gj26-5wx9
- CVE ID
- CVE-2022-35923
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Impact
Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().
Patches
v1.5.1
References
huntr.dev report Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking
For more information
If you have any questions or comments about this advisory:
- Open an issue in v8n issues list
- Email us at [email protected]
CWEs
- CWE-400 · Uncontrolled Resource Consumption
- CWE-1333 · Inefficient Regular Expression Complexity
References
- https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2022-35923 ↗
- https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9 ↗
- https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/ ↗
- https://github.com/advisories/GHSA-xrx9-gj26-5wx9 ↗