Regular Expression Denial of Service in underscore.string

Description

Versions of underscore.string prior to 3.3.5 are vulnerable to Regular Expression Denial of Service (ReDoS).

The function unescapeHTML is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.

Recommendation

Update the underscore.string package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.3.5
• Patched version(s): 3.3.5

References

• GHSA-v2p6-4mp7-3r9v
• www.npmjs.com
• CWE-400

Related Issues

• Regular Expression Denial of Service in clean-css - Vulnerability
• Regular Expression Denial of Service in marked - marked - GHSA-ch52-vgq2-943f - Vulnerability
• tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
• useragent Regular Expression Denial of Service vulnerability - CVE-2020-26311

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

underscore.string