Regular Expression Denial of Service in no-case

Description

Affected versions of no-case are vulnerable to a regular expression denial of service when parsing untrusted user input.

Recommendation

Update the no-case package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.2
• Patched version(s): 2.3.2

References

• GHSA-ff6r-5jwm-8292
• www.npmjs.com
• CVE-2017-16099
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in content - CVE-2017-16111
• Regular Expression Denial of Service in parsejson - CVE-2017-16113
• Regular Expression Denial of Service in timespan - CVE-2017-16115
• Regular Expression Denial Of Service in uri-js - CVE-2017-16021

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

no-case