Description
Affected versions of handlebars are vulnerable to Denial of Service. The package’s parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.
Recommendation
Update the handlebars package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.0.0, < 4.4.5
- Patched version(s): 4.4.5
References
Related Issues
- Denial of Service in rgb2hex - Vulnerability
- @stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags - Vulnerability
- SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimenta - Vulnerability
- string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) - CVE-2025-45143
You might also like:
- Tags:
- npm
- handlebars
Anything's wrong? Let us know Last updated on January 09, 2023