Regular expression denial of service in devcert

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

Recommendation

Update the devcert package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.2.1
• Patched version(s): 1.2.1

References

• GHSA-fp36-299x-pwmw
• research.jfrog.com
• CVE-2022-1929
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844
• http-cache-semantics vulnerable to Regular Expression Denial of Service - CVE-2022-25881
• jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method - CVE-2022-31147
• cookiejar Regular Expression Denial of Service via Cookie.parse function - CVE-2022-25901

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

devcert