CVE-2026-24001

CVE-2026-24001 concerns jsdiff, a JavaScript diff library. The description documents a denial-of-service vulnerability: if patch filenames contain line break characters (\r, \u2028, or \u2029), parsePatch can loop infinitely and exhaust memory, crashing the process. The issue affects versions pri...

EUVD-2026-2424

jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, and 4.0.4, attempting to parse a patch whose filename headers contain the line break characters \r, \u2028, or \u2029 can cause the parsePatch method to enter an infinite loop. It then consumes memory without...