Regular expression denial of service in react-native

Description

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.

Recommendation

Update the react-native package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.63.0, < 0.64.1

  >= 0.59.0, < 0.62.3**

• Patched version(s): **0.64.1

  0.62.3**

References

• GHSA-7f53-fmmv-mfjv
• www.npmjs.com
• CVE-2020-1920
• CWE-400
• CWE-697
• CAPEC-310
• OWASP 2021-A6

Related Issues

• is_js vulnerable to Regular Expression Denial of Service - CVE-2020-26302
• Regular expression denial of service in url-regex - CVE-2020-7661
• useragent Regular Expression Denial of Service vulnerability - CVE-2020-26311
• Knwl.js Regular Expression Denial of Service vulnerability - CVE-2020-26306

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

react-native