Description
Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.
Additional Details are available at Bugzilla
Credit: DayShift
Recommendation
Update the @mozilla/readability package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.6.0
- Patched version(s): 0.6.0
References
Related Issues
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - CVE-2025-67647
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - @sveltejs/adapter-node - CVE-2025-67647
- protobuf.js: Denial of service through unbounded protobuf recursion - CVE-2026-44289
- Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding - CVE-2025-68272
You might also like:
- Tags:
- npm
- @mozilla/readability
Anything's wrong? Let us know Last updated on March 26, 2025