nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...

PT-2021-5825 · Unknown +8 · Hosted-Git-Info +8

Name of the Vulnerable Software and Affected Versions: hosted-git-info versions prior to 3.0.8 Description: The issue is related to a Regular Expression Denial of Service ReDoS in the fromUrl function in index.js. This occurs due to the shortcutMatch regular expression, which exhibits polynomial...