myshenin/aws-lambda-multipart-parser · Security
AWS Lambda parser is vulnerable to Regular Expression Denial of Service
- GHSA ID
- GHSA-6jqp-j69q-pm62
- CVE ID
- CVE-2018-7560
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
index.js in the aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string.
CWEs
- CWE-20 · Improper Input Validation