ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function

Description

The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.

To demonstrate this vulnerability, here’s an example.

Recommendation

Update the vue package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0-alpha.1, < 3.0.0-alpha.0
• Patched version(s): 3.0.0-alpha.0

References

• GHSA-5j4c-8p2g-v4jx
• www.herodevs.com
• CVE-2024-9506
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack - CVE-2025-25289
• vue-i18n has cross-site scripting vulnerability with prototype pollution - CVE-2024-52809
• vue-i18n has cross-site scripting vulnerability with prototype pollution (GHSA-9r9m-ffp6-9x4v) - CVE-2024-52809
• vue-i18n has cross-site scripting vulnerability with prototype pollution (GHSA-9r9m-ffp6-9x4v) 4 - CVE-2024-52809

Tags:

npm

vue