npm string vulnerabilities

Latest npm string CVEs

Newest publication first

1. CVE-2017-16116 Regular Expression Denial of Service in string package

   Published 2018-06-07

   High·CVSS 7.5

   The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.