CVE-2018-7651 Regular Expression Denial of Service in ssri
MediumCVSS 5.9
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long base64 hash string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm ssri(npm) | < 5.2.2 | 5.2.2 |
| debian/node-ssri(Debian:12) | < 5.2.4-1 | 5.2.4-1 |
| debian/node-ssri(Debian:14) | < 5.2.4-1 | 5.2.4-1 |
| debian/node-ssri(Debian:13) | < 5.2.4-1 | 5.2.4-1 |
| ssri project ssri | < 5.2.2 | 5.2.2 |
References
- nvd.nist.gov third-party-advisory
- github.com
- www.npmjs.com
- github.com third-party-advisory
- github.com patch third-party-advisory
- Debian Security Tracker CVE-2018-7651 vendor-advisory
- bugs.debian.org issue-tracking
- nodesecurity.io third-party-advisory