4464 matches found
CVE-2018-3737
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...
CVE-2018-3738
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...
CVE-2018-3737
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...
CVE-2017-16086
CVE-2017-16086 affects the ua-parser-js module (ua-parser) and can be triggered by a specially crafted User-Agent header, causing a Regular Expression Denial of Service (ReDoS). The vulnerability is documented with a CVSS v3.0 base score of 7.5 (HIGH) and visible in NVD; a prior v2.0 score is 5.0...
CVE-2018-3738: Allocation of Resources Without Limits or Throttling
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...
CVE-2017-16113: Uncontrolled Resource Consumption
The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed...
CVE-2017-16098: Uncontrolled Resource Consumption
charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb, so the impact of the ReDoS is...
CVE-2017-16137: Uncontrolled Resource Consumption
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...
CVE-2017-16086: Uncontrolled Resource Consumption
ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...
CVE-2017-16136: Uncontrolled Resource Consumption
method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed...
CVE-2018-3737: Allocation of Resources Without Limits or Throttling
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...
CVE-2017-16021
The CVE-2017-16021 issue affects uri-js up to v2.1.1 where a RegExp-based URL validation can cause a Denial of Service (high CPU usage) when processing user input via parse(). Fedora/Nessus/OpenVAS entries reference CVE-2017-16021 and indicate to update to a newer nodejs-uri-js release to fix the...
CVE-2017-16021: Uncontrolled Resource Consumption
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...
CVE-2016-10540
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatchpath, pattern in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter...
DEBIAN-CVE-2016-10539
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...
CVE-2016-10540
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatchpath, pattern in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter...
AZL-44502 CVE-2016-10540 affecting package js-jquery 3.5.0-4
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatchpath, pattern in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter...
Code injection
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatchpath, pattern in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter...