Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
Recommendation
Update the devcert package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.2.1
- Patched version(s): 1.2.1
References
Could your website be exposed too?
SmartScanner can check your website for Regular expression denial of service in devcert and gives you actionable findings to investigate.
Start a free scanRelated Issues
- angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844
- http-cache-semantics vulnerable to Regular Expression Denial of Service - CVE-2022-25881
- jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method - CVE-2022-31147
- cookiejar Regular Expression Denial of Service via Cookie.parse function - CVE-2022-25901
You might also like:
See something that needs correcting? Let us knowUpdated November 29, 2023