Regular Expression Denial Of Service (ReDoS)

2023-01-1104:24:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

redos vulnerability

terminal-kit

insecure regex pattern

malicious strings

crash

application

bignumber

EPSS

0.002

Percentile

52.4%

JSON

terminal-kit is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used in multiple functions of the library, allowing an attacker to crash the application by providing a malicious strings such as '^['.repeat(bigNumber).