Description
isRepeatedSingleCharRun() in src/analysis.ts (line 285) re-scans the entire accumulated segment on every merge iteration during text analysis, producing O(n²) total work for input consisting of repeated identical punctuation characters.
Recommendation
Update the @chenglou/pretext package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.0.4
- Patched version(s): 0.0.5
References
Could your website be exposed too?
SmartScanner can check your website for Pretext: Algorithmic Complexity (DoS) in the text analysis phase and gives you actionable findings to investigate.
Start a free scanRelated Issues
- linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text - CVE-2026-59887
- axios Inefficient Regular Expression Complexity vulnerability - CVE-2021-3749
- markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations - CVE-2026-48988
- flatted vulnerable to unbounded recursion DoS in parse() revive phase - CVE-2026-32141
You might also like:
See something that needs correcting? Let us knowUpdated April 08, 2026