Description
Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.7.9
References
Could your website be exposed too?
SmartScanner can check your website for MathJax Regular expression Denial of Service (ReDoS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Switcher Client contains Regular Expression Denial of Service (ReDoS) - CVE-2023-23925
- word-wrap vulnerable to Regular Expression Denial of Service - CVE-2023-26115
- Regular Expression Denial of Service (ReDOS) - color-string - CVE-2021-29060
- tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
You might also like:
See something that needs correcting? Let us knowUpdated January 31, 2024