CVE-2018-7158

The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service ReDoS vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, splitPathRe, used within the...

CVE-2018-7158

CVE-2018-7158: Node.js path module ReDoS vulnerability affecting the 4.x release line; crafted file paths in path.dirname, path.extname, path.parse can cause excessive evaluation time. Fixed in Node.js 6.x+; IBM advisories for IBM SDK for Node.js (6.x and 8.x) indicate remediation via upgrading t...

CVE-2018-7158

The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service ReDoS vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, splitPathRe, used within the...

Denial of Service

Overview All versions of rgb2hex are vulnerable to Regular Expression Denial of Service ReDoS when an attacker can pass in a specially crafted invalid color value. Recommendation Update to version 0.1.6 or later. References - HackerOne Report -...

Regular Expression Denial Of Service (ReDoS)

bson is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability exists due to the use of improper regular expression that consumes a large amount of resources when parsing large strings...

Regular Expression Denial Of Service (ReDoS)

foreman is vulnerable to regular expression denial of service ReDoS. The vulnerability is possible because regular expressions used for URL path are not filtering the evil string input by the attacker...

Regular Expression Denial of Service

Overview Version of is-my-json-valid before 1.4.1 or 2.17.2 are vulnerable to regular expression denial of service ReDoS via the email validation function. Recommendation Update to version 1.4.1, 2.17.2 or later. References - GitHub PR 159 - GitHub Commit b3051b2 - HackerOne Report - GitHub Advis...

CVE-2018-1109

A vulnerability was found in nodejs-braces. Affected versions of this package are vulnerable to Regular expression Denial of Service ReDoS attacks. The highest threat from this vulnerability is system availability...

Regular Expression Denial Of Service (ReDoS)

sshpk is vulnerable to Regular expression Denial of Service ReDoS. Due to weak regular expression choice used for public key, attackers are able to pass a malicious public key string , leading to a huge performance slow down...

Regular Expression Denial Of Service (ReDoS)

protobufjs is vulnerable to regular expression denial of service ReDoS. The attack can be triggered when the attacker parses or loads .proto file sources using malicious file or regex or string...

node.js -- multiple vulnerabilities

Node.js reports: Node.js Inspector DNS rebinding vulnerability CVE-2018-7160 Node.js 6.x and later include a debugger protocol also known as "inspector" that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which coul...

Regular Expression Denial of Service in ssri

Version of ssri prior to 5.2.2 are vulnerable to regular expression denial of service ReDoS when using strict mode. Recommendation Update to version 5.2.2 or later...

Regular Expression Denial Of Service (ReDoS)

Django is vulnerable to regular expression denial of service ReDoS attacks. The application takes more than linear time when certain strings are passed to the text truncating function, resulting in a DoS...

Regular Expression Denial Of Service (ReDoS)

Django is vulnerable to regular expression denial of service attacks.The application takes more than linear time when certain strings are passed to the urlize function, resulting in an application crash...

AWS Lambda parser is vulnerable to Regular Expression Denial of Service

index.js in the aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service ReDoS issue via a crafted multipart/form-data boundary string...

GHSA-6JQP-J69Q-PM62 AWS Lambda parser is vulnerable to Regular Expression Denial of Service

index.js in the aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service ReDoS issue via a crafted multipart/form-data boundary string...

111-react-simpleform (>=1.0.0, <=1.0.6), 1405_logging (1.0.0) +5115 more potentially affected by CVE-2017-18214 via moment (>=2.0.0, <=2.19.2)

moment NPM version =2.0.0, =1.0.0, =0.1.0, =0.1.0, =0.2.4, =0.2.0, =0.0.1, =0.2.1, =0.0.2, =1.0.0-beta.1, =1.43.0, =1.70.1, =1.70.1, =1.103.2 and more Source cves: CVE-2017-18214 Source advisory: OSV:GHSA-446M-MV8F-Q348...

Regular Expression Denial Of Service (ReDoS)

marked is vulnerable to regular expression denial of service ReDoS attacks.The application takes more than linear time when scanning certain strings, resulting in a DoS...

Regular Expression Denial Of Service (ReDoS)

aws-lambda-multipart-parser is vulnerable to regular expression denial of service ReDoS attacks. These attacks are possible through a multipart/form-data boundary string and allows attackers to inject and execute arbitrary code...

Design/Logic Flaw

index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service ReDoS issue via a crafted multipart/form-data boundary string...