CVE-2021-23354

2021-03-1215:15:14

Google

osv.dev

cve-2021-23354

redos

printf package

AI Score

6.7

Confidence

High

EPSS

0.002

Percentile

57.4%

JSON

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /%(?:(([\w_.]+))|([1-9]\d*)$)?([0 +-]*)(*|\d+)?(.)?(*|\d+)?[hlL]?([%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.