ReDoS in urlregex

Description

A vulnerability was found in nescalante urlregex up to 0.5.0 and classified as problematic. This issue affects some unknown processing of the file index.js of the component Backtracking. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely.

Recommendation

Update the urlregex package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.5.1
• Patched version(s): 0.5.1

References

• GHSA-rw72-v6c7-hf9r
• vuldb.com
• CVE-2020-36830
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDoS) in lodash - CVE-2020-28500
• regular expression denial of service (ReDoS) - date-and-time - CVE-2020-26289
• Regular Expression Denial of Service (ReDoS) in lodash - lodash-es - CVE-2020-28500
• Regular Expression Denial of Service (ReDoS) in lodash - lodash.trimend - CVE-2020-28500

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

urlregex