@mozilla/readability Denial of Service through Regex

Description

Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.

Additional Details are available at Bugzilla

Credit: DayShift

Recommendation

Update the @mozilla/readability package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.6.0
• Patched version(s): 0.6.0

References

• GHSA-3p6v-hrg8-8qj7
• bugzilla.mozilla.org
• CVE-2025-2792
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• svelte is vulnerable to XSS with textarea bind:value - Vulnerability
• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) - CVE-2019-10744
• Prototype Pollution in lodash (GHSA-4xc9-xhrj-v574) - CVE-2018-16487
• jquery-validation vulnerable to Cross-site Scripting - CVE-2025-3573

Tags:

npm

@mozilla/readability