Regular Expression Denial of Service (ReDoS) in lodash

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. Steps to reproduce provided by reporter Liyuan Chen: var lo = require'lodash'; function buildblankn var ret = "1" for var i = 0; i n; i++ ret ...

GHSA-XX4C-JJ58-R7X6 Inefficient Regular Expression Complexity in Validator.js

Impact Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers. Patches The problem has been patched in validator 13.7.0...

PT-2021-21765 · Unknown · Validator.Js

Name of the Vulnerable Software and Affected Versions: validator.js versions prior to 13.7.0 Description: The issue is related to Inefficient Regular Expression Complexity. It affects the rtrim and trim sanitizers. There is no information provided about the estimated number of potentially affecte...

in bookstackapp/bookstack

Description The image extension validation service for Base64 image extraction in new Bookstack version is flawed as it uses the vulnerable trim function. This allows attackers to upload malicious files with broken extension, such as pngr, and browsers will interpret broken extension hosted on th...

nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions

A flaw was found in nodejs-lodash. A Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions is possible...

Uncontrolled Resource Consumption in trim-off-newlines

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service ReDoS via string processing...

Regular Expression Denial Of Service (ReDoS)

axios is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in trim in utils.js due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious string as a header...

CVE-2021-23425

CVE-2021-23425 affects the nodejs-trim-off-newlines package; all versions of trim-off-newlines are vulnerable to ReDoS via string processing. The issue is confirmed in multiple sources (NVD entry and Red Hat advisory RHSA-2022:4711) with an overall Medium impact (CVSS v3.1 base score 5.3; Availab...

CVE-2021-23425

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service ReDoS via string processing...

stevemao trim-off-newlines 处理逻辑错误漏洞

trim-off-newlines is used by NPM to remove line breaks. A processing logic error vulnerability exists in stevemao trim-off-newlines that stems from the fact that all versions of trim-off-newlines are susceptible to a Regular Expression Denial of Service ReDoS attack via string processing...

PT-2021-12045 · Unknown · Uwebsockets

Name of the Vulnerable Software and Affected Versions: uWebSockets versions 18.11.0 through 18.12.0 Description: The issue is related to a stack-based buffer overflow in the uWS::TopicTree::trimTree function, which is called from uWS::TopicTree::unsubscribeAll. The vendor disputes the severity of...

The vulnerability of the toNumber, trim, and trimEnd functions in the lodash library for application software from Aurora Center involves an uncontrolled resource consumption, allowing attackers to cause service failures.

The vulnerability of the toNumber, trim, and trimEnd functions in the lodash library for application software from Aurora Center involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Regular Expression Denial of Service

Overview trim-newlines before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method. Recommendation Upgrade to versions 3.0.1 or 4.0.1 or later References - CVE - GitHub Advisory...

Uncontrolled Resource Consumption in trim-newlines

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method...

@tiendanube/components (>=0.0.2, <=2.4.2), @tiendanube/icons (>=0.1.1, <=0.2.8) +2 more potentially affected by CVE-2021-33623 via trim-newlines (3.0.0)

trim-newlines NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on trim-newlines and may be impacted: - @tiendanube/components =0.0.2, =0.1.1, =1.0.1, =1.0.2 Source cves: CVE-2021-33623 Source advisory: OSV:GHSA-7P7H-4MM5-852V...

GHSA-7P7H-4MM5-852V Uncontrolled Resource Consumption in trim-newlines

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method...

Unspecified vulnerability in Joyent trim-newlines

trim-newlines is an npm package that modifies line breaks. A security vulnerability exists in Joyent trim-newlines, which stems from an issue related to the .end method as applied to Node.js in versions 3.0.1 and 4.0.1 and earlier. No details of the vulnerability are available at this time...

CVE-2021-33623

A flaw was found in nodejs-trim-newlines. Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method...

nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions

A flaw was found in nodejs-lodash. A Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions is possible...

Regular Expression Denial Of Service (ReDoS)

trim-newlines is vulnerable to Regular Expression Denial Of Service ReDoS. The usage of an insecure regular expression in the .end method allows an attacker to cause excessive resource consumption...