AZL-44496 CVE-2017-16118 affecting package nodejs-nodemon 2.0.3-5

The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition...

CVE-2017-16117

slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds...

CVE-2017-16115

The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds...

CVE-2017-16117: Uncontrolled Resource Consumption

slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds...

CVE-2017-16099: Uncontrolled Resource Consumption

The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition...

PT-2018-6144

Name of the Vulnerable Software and Affected Versions: slug versions prior to 0.9.2 Description: The issue concerns a regular expression denial of service in the slug module when specially crafted untrusted input is passed. This can cause the event loop to block for 2 seconds with approximately...

Regular Expression Denial Of Service (ReDoS)

forwarded is vulnerable to regular expression denial of service ReDoS. A flaw when the x-forwarded-for header is parsed causes the event loop to be blocked...

Regular Expression Denial Of Service (ReDoS)

fresh is vulnerable to regular expression denial of service ReDoS.The vulnerability exists when matching multiple ETags in If-None-Match which causes the event loop to be blocked...

Regular Expression Denial of Service

Overview The jshamcrest package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in to the emailAddress validator. Proof of concept var js = require'jshamcrest' var emailAddress = new js.JsHamcrest.Matchers.emailAddress; var genstr =...