Regular Expression Denial of Service in timespan

Description

Affected versions of timespan are vulnerable to a regular expression denial of service when parsing dates.

The amplification for this vulnerability is significant, with 50,000 characters resulting in the event loop being blocked for around 10 seconds.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.3.0

References

• GHSA-f523-2f5j-gfcg
• www.npmjs.com
• CVE-2017-16115
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Auth0 NextJS SDK v4 Missing Session Invalidation - CVE-2025-46344
• Potential DoS when using ContextLines integration - Vulnerability
• sanitize-html Information Exposure vulnerability - CVE-2024-21501
• json-schema-ref-parser Prototype Pollution issue - CVE-2024-29651

Tags:

npm

timespan