Regular Expression Denial of Service in ansi2html

Description

The ansi2html package is affected by a regular expression denial of service vulnerability when certain types of user input is passed in.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.0.0

References

• GHSA-c2v2-7rcg-2ch7
• www.npmjs.com
• CVE-2015-9239
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in marked - CVE-2015-8854
• Regular Expression Denial of Service in ms - CVE-2015-8315
• Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-widget - CVE-2021-21391
• Regular Expression Denial of Service in dat.gui - CVE-2020-7755

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

ansi2html