Lucene search

K
nvd[email protected]NVD:CVE-2023-30858
HistoryApr 28, 2023 - 9:15 p.m.

CVE-2023-30858

2023-04-2821:15:09
CWE-1333
web.nvd.nist.gov
3
denosaurs emoji package
retrimspace regex
inefficiency
delayed response
big payload
patch
workaround
replace function
unemojify function
strip function

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.0%

The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. The issue has been patched in 0.3.0. As a workaround, avoid using the replace, unemojify, or strip functions.

Affected configurations

NVD
Node
denosaursemojiRange0.1.00.3.0

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.0%

Related for NVD:CVE-2023-30858