Description
The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.
To demonstrate this vulnerability, here’s an example.
Recommendation
Update the vue package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0-alpha.1, < 3.0.0-alpha.0
- Patched version(s): 3.0.0-alpha.0
References
Could your website be exposed too?
SmartScanner can check your website for ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function and gives you actionable findings to investigate.
Start a free scanRelated Issues
- vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/core-base - CVE-2024-52809
- @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack - CVE-2025-25289
- @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - CVE-2025-25285
- @intlify/shared Prototype Pollution vulnerability - vue-i18n - CVE-2024-52810
You might also like:
See something that needs correcting? Let us knowUpdated October 24, 2024