PT-2018-6128

Name of the Vulnerable Software and Affected Versions: no-case versions prior to 2.3.2 Description: The issue concerns a regular expression denial of service in the no-case module. When malicious untrusted user input is passed into no-case, it can block the event loop, causing a denial of service...

PT-2018-16161 · Protobufjs · Protobufjs

Name of the Vulnerable Software and Affected Versions: protobufjs versions prior to 5.0.3 protobufjs versions prior to 6.8.6 Description: The issue concerns a regular expression denial of service when parsing crafted invalid .proto files, potentially leading to ReDoS. Recommendations: Update to...

PT-2018-6145

Name of the Vulnerable Software and Affected Versions: forwarded versions prior to 0.1.2 Description: The issue affects the forwarded module used by the Express.js framework to handle the X-Forwarded-For header. It is susceptible to a regular expression denial of service when passed specially...

PT-2018-6142

Name of the Vulnerable Software and Affected Versions: timespan affected versions not specified Description: The timespan module is vulnerable to a regular expression denial of service. This issue can cause significant amplification, with 50,000 characters of untrusted user input resulting in the...

PT-2018-6127

Name of the Vulnerable Software and Affected Versions: charset versions 1.0.0 and below Description: The issue concerns a regular expression denial of service. It is noted that an input of around 50,000 characters is required to cause a slow down of approximately 2 seconds. The impact of this iss...

PT-2018-3672

Name of the Vulnerable Software and Affected Versions debug versions prior to 2.6.9 debug versions 3.2.0 through 3.2.6 debug versions 4.0.0 through 4.3.0 Description The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. Th...

PT-2018-6164

Name of the Vulnerable Software and Affected Versions: method-override versions prior to 2.3.10 Description: The issue concerns a regular expression denial of service vulnerability. It occurs when specially crafted input is passed to be parsed via the X-HTTP-Method-Override header. This can happe...

PT-2018-6144

Name of the Vulnerable Software and Affected Versions: slug versions prior to 0.9.2 Description: The issue concerns a regular expression denial of service in the slug module when specially crafted untrusted input is passed. This can cause the event loop to block for 2 seconds with approximately...

PT-2018-6140

Name of the Vulnerable Software and Affected Versions: content versions prior to 3.0.6 Description: The issue affects the content module, which is used by the hapijs framework to parse HTTP Content- headers. It is vulnerable to regular expression denial of service when passed specifically crafted...

PT-2018-6165

Name of the Vulnerable Software and Affected Versions: mime versions prior to 1.4.1 mime versions 2.0.1, 2.0.2 Description: The issue concerns a regular expression denial of service that occurs when a mime lookup is performed on untrusted user input. Recommendations: For mime versions prior to...

CVE-2017-16138: Uncontrolled Resource Consumption

The mime module 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input...

CVE-2017-16116: Uncontrolled Resource Consumption

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...

CVE-2017-16098: Uncontrolled Resource Consumption

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb, so the impact of the ReDoS is...

CVE-2017-16114: Uncontrolled Resource Consumption

The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds...

CVE-2017-16118: Uncontrolled Resource Consumption

The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

Code injection

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

PT-2018-6041

Name of the Vulnerable Software and Affected Versions: jquery versions prior to 1.9.0 Description: The issue occurs because the main jquery function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. This results in jquery...