(ReDoS) Regular Expression Denial of Service in tf2-item-format

Description

Versions of tf2-item-format since at least 4.2.6 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input.

Recommendation

Update the tf2-item-format package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.2.6, <= 5.9.13
• Patched version(s): 5.9.14

References

• GHSA-8h55-q5qq-p685
• CVE-2024-41655
• CWE-1333
• CWE-624
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing - CVE-2024-1899
• parse-uri Regular expression Denial of Service (ReDoS) - CVE-2024-36751
• parse-uri Regular expression Denial of Service (ReDoS) - parse-uri - CVE-2024-36751
• Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

tf2-item-format