Description
Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().
Recommendation
Update the v8n package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.5.1
- Patched version(s): 1.5.1
References
Could your website be exposed too?
SmartScanner can check your website for v8n vulnerable to Inefficient Regular Expression Complexity and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Moment.js vulnerable to Inefficient Regular Expression Complexity - CVE-2022-31129
- Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity - CVE-2025-58451
- inflect vulnerable to Inefficient Regular Expression Complexity - CVE-2021-3820
- markdown-it vulnerable to Inefficient Regular Expression Complexity - CVE-2015-10005
You might also like:
See something that needs correcting? Let us knowUpdated July 31, 2023