What is GHSA-39q4-p535-c852?

GHSA-39q4-p535-c852 is a security advisory published by GitHub Security Advisories with High severity. Uncontrolled Resource Consumption in locutus

Which CVE IDs does GHSA-39q4-p535-c852 cover?

GHSA-39q4-p535-c852 covers the following CVE IDs: CVE-2021-23392. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-39q4-p535-c852?

GHSA-39q4-p535-c852 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-39q4-p535-c852?

GHSA-39q4-p535-c852 affects 1 product, including: npm/locutus:\u003c 2.0.15.

GHSA-39q4-p535-c852HighCVSS 7.5

Uncontrolled Resource Consumption in locutus

Vendor

GitHub Security Advisories

Published

June 10, 2021

Last Modified

September 7, 2023

🔗 CVE IDs covered (1)

CVE-2021-23392 →

📋 Description

The package locutus before 2.0.15 is vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.

🎯 Affected products1

npm/locutus:< 2.0.15

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-23392
https://github.com/locutusjs/locutus/pull/446
https://github.com/locutusjs/locutus/commit/eb863321990e7e5514aa14f68b8d9978ece9e65e
https://snyk.io/vuln/SNYK-JS-LOCUTUS-1090597
https://github.com/advisories/GHSA-39q4-p535-c852