Description
Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.
Additional Details are available at Bugzilla
Credit: DayShift
Recommendation
Update the @mozilla/readability package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.6.0
- Patched version(s): 0.6.0
References
Related Issues
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - CVE-2025-67647
- Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding - CVE-2025-68272
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering (GHSA-j62c-4x62-9r35) - CVE-2025-67647
- jsPDF Bypass Regular Expression Denial of Service (ReDoS) - CVE-2025-29907
- Tags:
- npm
- @mozilla/readability
Anything's wrong? Let us know Last updated on March 26, 2025