Description
This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.
Recommendation
Update the html-parse-stringify package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.1
- Patched version(s): 2.0.1
References
Could your website be exposed too?
SmartScanner can check your website for html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - html-parse-stringify and gives you actionable findings to investigate.
Start a free scanRelated Issues
- html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346
- jspdf vulnerable to Regular Expression Denial of Service (ReDoS) - CVE-2021-23353
- Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing - CVE-2024-1899
- Regular Expression Denial of Service (ReDoS) in jsx-slack - CVE-2021-43838
You might also like:
See something that needs correcting? Let us knowUpdated September 12, 2023