Description
Versions of underscore.string prior to 3.3.5 are vulnerable to Regular Expression Denial of Service (ReDoS).
The function unescapeHTML is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.
Recommendation
Update the underscore.string package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.3.5
- Patched version(s): 3.3.5
References
Could your website be exposed too?
SmartScanner can check your website for Regular Expression Denial of Service in underscore.string and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Regular Expression Denial of Service in clean-css - Vulnerability
- Regular Expression Denial of Service in marked - marked - GHSA-ch52-vgq2-943f - Vulnerability
- tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
- useragent Regular Expression Denial of Service vulnerability - CVE-2020-26311
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023