GHSA-4gmj-3p3h-gm8h

Source

https://github.com/advisories/GHSA-4gmj-3p3h-gm8h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-4gmj-3p3h-gm8h/GHSA-4gmj-3p3h-gm8h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4gmj-3p3h-gm8h

Aliases

CVE-2024-27088

Published

2024-02-26T20:01:28Z

Modified

2024-02-26T20:28:49.350703Z

Summary

es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

Details

Impact

Passing functions with very long names or complex default argument names into function#copy orfunction#toStringTokens may put script to stall

Patches

Fixed with https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2 and https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602 Published with v0.10.63

Workarounds

No real workaround aside of refraining from using above utilities.

References

https://github.com/medikoo/es5-ext/issues/201

Database specific

{
    "cwe_ids": [
        "CWE-1333"
    ],
    "nvd_published_at": "2024-02-26T17:15:11Z",
    "github_reviewed": true,
    "severity": "LOW",
    "github_reviewed_at": "2024-02-26T20:01:28Z"
}

References

Affected packages

npm / es5-ext

Package

Name: es5-ext; View open source insights on deps.dev
Purl: pkg:npm/es5-ext

Affected ranges

Type: SEMVER
Events: Introduced

0.10.0

Fixed

0.10.63