Regular Expression Denial Of Service (ReDoS)

2021-03-0500:54:55

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

69.7%

JSON

html-parse-stringify2 is vulnerable to regular express denial of service (ReDoS). The vulnerability exists through the regular expression of tagRE where parsing strings with multiple ' and " can consume huge amount of CPU resources.

CPENameOperatorVersion
html-parse-stringify2le2.0.0

CPE	Name	Operator	Version
	html-parse-stringify2	le	2.0.0

References

github.com/advisories/GHSA-545q-3fg6-48m7

github.com/HenrikJoreteg/html-parse-stringify/blob/master/lib/parse.js%23L2

github.com/HenrikJoreteg/html-parse-stringify/commit/c7274a48e59c92b2b7e906fedf9065159e73fe12

github.com/rayd/html-parse-stringify2/blob/master/lib/parse.js%23L2

0.003 Low

EPSS

Percentile

69.7%

JSON

Related for VERACODE:29575