Security Advisory

CVE-2021-23354

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2021-03-12 15:10:16

Last updated 2024-09-17 03:32:43

Assigner snyk

CVSS score 5.3

State PUBLISHED

Description

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:$([\w_.]+)$|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.

← Browse all CVEs View on cve.org ↗