Inefficient Regular Expression Complexity in nth-check

Description

There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.

The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern \s*(?:([+-]?)\s*(\d+))? with quantified overlapping adjacency and can be exploited with the following code.

Recommendation

Update the nth-check package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.1
• Patched version(s): 2.0.1

References

• GHSA-rp65-9cf3-cjxr
• huntr.dev
• lists.debian.org
• CVE-2021-3803
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• string-kit Inefficient Regular Expression Complexity vulnerability - CVE-2021-4299
• Inefficient Regular Expression Complexity in chalk/ansi-regex - CVE-2021-3807
• Inefficient Regular Expression Complexity in validator.js - CVE-2021-3765
• Inefficient Regular Expression Complexity in handsontable - CVE-2021-23446

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nth-check