Switcher Client contains Regular Expression Denial of Service (ReDoS)

Description

Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS).

Recommendation

Update the switcher-client package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.1.4
• Patched version(s): 3.1.4

References

• GHSA-wqxw-8h5g-hq56
• CVE-2023-23925
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• MathJax Regular expression Denial of Service (ReDoS) - CVE-2023-39663
• Regular Expression Denial of Service (ReDoS) - CVE-2021-28092
• angular vulnerable to regular expression denial of service via the $resource service - CVE-2023-26117
• Regular Expression Denial of Service (ReDoS) - ssri - CVE-2021-27290

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

switcher-client