uri-template-lite Regular Expression Denial of Service

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the “URI.expand” method.

Recommendation

Update the uri-template-lite package to the latest compatible version. Followings are version details:

• Affected version(s): < 22.9.0
• Patched version(s): 22.9.0

References

• GHSA-chw2-6c7r-37p7
• research.jfrog.com
• CVE-2021-43309
• CWE-1333
• CWE-697
• CAPEC-310
• OWASP 2021-A6

Related Issues

• prismjs Regular Expression Denial of Service vulnerability - CVE-2021-3801
• parse-uri Regular expression Denial of Service (ReDoS) - CVE-2024-36751
• parse-uri Regular expression Denial of Service (ReDoS) - parse-uri - CVE-2024-36751
• Regular expression Denial of Service in multiple packages - CVE-2021-21391

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

uri-template-lite