@fendy3002/string-tools (>=0.1.0, <=0.1.2), @mediafly/js-ui (>=26.0.1, <=46.3.1-beta.0) +177 more potentially affected by CVE-2020-26302 via is_js (>=0.2.1, <=0.8.0)

isjs NPM version =0.2.1, =0.1.0, =26.0.1, =0.0.1, =1.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.4, =0.1.1, =0.1.0, =0.1.0, =0.1.4 and more Source cves: CVE-2020-26302 Source advisory: OSV:GHSA-PVRW-G6FX-MCX2...

CVE-2020-26302

CVE-2020-26302 affects the is.js library. Versions ≤ 0.9.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via a URL-validation regex copied from a gist; under malicious input the regex can loop indefinitely. The issue is documented across multiple sources (e.g., GHSA- PVRW-G6FX-MC...

CVE-2020-26302

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to...

CVE-2020-26302

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to...

CVE-2020-26302

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to...