8224 matches found
PT-2018-6145
Name of the Vulnerable Software and Affected Versions: forwarded versions prior to 0.1.2 Description: The issue affects the forwarded module used by the Express.js framework to handle the X-Forwarded-For header. It is susceptible to a regular expression denial of service when passed specially...
PT-2018-6142
Name of the Vulnerable Software and Affected Versions: timespan affected versions not specified Description: The timespan module is vulnerable to a regular expression denial of service. This issue can cause significant amplification, with 50,000 characters of untrusted user input resulting in the...
PT-2018-6127
Name of the Vulnerable Software and Affected Versions: charset versions 1.0.0 and below Description: The issue concerns a regular expression denial of service. It is noted that an input of around 50,000 characters is required to cause a slow down of approximately 2 seconds. The impact of this iss...
PT-2018-3672
Name of the Vulnerable Software and Affected Versions debug versions prior to 2.6.9 debug versions 3.2.0 through 3.2.6 debug versions 4.0.0 through 4.3.0 Description The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. Th...
PT-2018-6164
Name of the Vulnerable Software and Affected Versions: method-override versions prior to 2.3.10 Description: The issue concerns a regular expression denial of service vulnerability. It occurs when specially crafted input is passed to be parsed via the X-HTTP-Method-Override header. This can happe...
PT-2018-6144
Name of the Vulnerable Software and Affected Versions: slug versions prior to 0.9.2 Description: The issue concerns a regular expression denial of service in the slug module when specially crafted untrusted input is passed. This can cause the event loop to block for 2 seconds with approximately...
PT-2018-6140
Name of the Vulnerable Software and Affected Versions: content versions prior to 3.0.6 Description: The issue affects the content module, which is used by the hapijs framework to parse HTTP Content- headers. It is vulnerable to regular expression denial of service when passed specifically crafted...
PT-2018-6165
Name of the Vulnerable Software and Affected Versions: mime versions prior to 1.4.1 mime versions 2.0.1, 2.0.2 Description: The issue concerns a regular expression denial of service that occurs when a mime lookup is performed on untrusted user input. Recommendations: For mime versions prior to...
CVE-2017-16138: Uncontrolled Resource Consumption
The mime module 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input...
CVE-2017-16116: Uncontrolled Resource Consumption
The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...
CVE-2017-16021
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...
CVE-2017-16021
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...
Code injection
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...
CVE-2017-16021
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...
PT-2018-6041
Name of the Vulnerable Software and Affected Versions: jquery versions prior to 1.9.0 Description: The issue occurs because the main jquery function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. This results in jquery...
CVE-2017-16023: Uncontrolled Resource Consumption
Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a string and takes unescaped separator values, which can be used to create a denial of service attack...
PT-2018-6052 · Github · Uri.Js
Name of the Vulnerable Software and Affected Versions: uri-js versions 2.1.1 and earlier Description: The issue arises from a regular expression used by uri-js to validate URLs, which is vulnerable to redos. This vulnerability causes the program to hang and results in 100% CPU usage when attempti...
CVE-2016-10539
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...
CVE-2016-10539
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...