Pretext: Algorithmic Complexity (DoS) in the text analysis phase

Description

isRepeatedSingleCharRun() in src/analysis.ts (line 285) re-scans the entire accumulated segment on every merge iteration during text analysis, producing O(n²) total work for input consisting of repeated identical punctuation characters.

Recommendation

Update the @chenglou/pretext package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.0.4
• Patched version(s): 0.0.5

References

• GHSA-5478-66c3-rhxr
• CWE-407

Related Issues

• linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text - CVE-2026-59887
• axios Inefficient Regular Expression Complexity vulnerability - CVE-2021-3749
• markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations - CVE-2026-48988
• flatted vulnerable to unbounded recursion DoS in parse() revive phase - CVE-2026-32141

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@chenglou/pretext