Regular expression Denial of Service in @progfay/scrapbox-parser

Description

A Regular expression Denial of Service flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js. The attacker that is able to be parsed a specially crafted text may cause the application to consume an excessive amount of CPU.

Recommendation

Update the @progfay/scrapbox-parser package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 7.0.0, < 7.0.2

  < 6.0.3**

• Patched version(s): **7.0.2

  6.0.3**

References

• GHSA-9fhw-r42p-5c7r
• security.netapp.com
• CVE-2021-27405
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDoS) in ua-parser-js - CVE-2021-27292
• Regular Expression Denial of Service (ReDoS) in Prism - CVE-2021-32723
• html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - html-parse-stringify - CVE-2021-23346
• Regular expression denial of service in jquery-validation - jquery-validation - CVE-2021-43306

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@progfay/scrapbox-parser