v8n vulnerable to Inefficient Regular Expression Complexity

Description

Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().

Recommendation

Update the v8n package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.5.1
• Patched version(s): 1.5.1

References

• GHSA-xrx9-gj26-5wx9
• huntr.dev
• CVE-2022-35923
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Moment.js vulnerable to Inefficient Regular Expression Complexity - CVE-2022-31129
• Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity - CVE-2025-58451
• inflect vulnerable to Inefficient Regular Expression Complexity - CVE-2021-3820
• markdown-it vulnerable to Inefficient Regular Expression Complexity - CVE-2015-10005

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

v8n