Regular Expression Denial of Service (ReDoS) in Prism

Description

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).

Recommendation

Update the prismjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.24.0
• Patched version(s): 1.24.0

References

• GHSA-gj77-59wh-66hg
• www.oracle.com
• CVE-2021-32723
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDOS) - color-string - CVE-2021-29060
• html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346
• semver-regex Regular Expression Denial of Service (ReDOS) - CVE-2021-3795
• Regular Expression Denial of Service (ReDoS) - CVE-2021-28092

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

prismjs