ReDOS in IS-SVG

Description

A vulnerability was discovered in IS-SVG version 4.3.1 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

Recommendation

Update the is-svg package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.1.0, < 4.3.0
• Patched version(s): 4.3.0

References

• GHSA-r8j5-h5cx-65gg
• www.npmjs.com
• CVE-2021-29059
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDoS) - CVE-2021-28092
• Regular Expression Denial of Service (ReDOS) - color-string - CVE-2021-29060
• Regular Expression Denial of Service (REDoS) in Marked - CVE-2021-21306
• semver-regex Regular Expression Denial of Service (ReDOS) - CVE-2021-3795

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

is-svg