What is GHSA-86p3-4gfq-38f2?

GHSA-86p3-4gfq-38f2 is a security advisory published by GitHub Security Advisories with Medium severity. Denial of Service in url-relative

Why does GHSA-86p3-4gfq-38f2 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-86p3-4gfq-38f2?

GHSA-86p3-4gfq-38f2 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-86p3-4gfq-38f2?

GHSA-86p3-4gfq-38f2 affects 1 product, including: npm/url-relative:\u003c= 1.0.0.

GHSA-86p3-4gfq-38f2MediumCVSS 5.9Disclosed before NVD

Denial of Service in url-relative

Vendor

GitHub Security Advisories

Published

June 5, 2019

Last Modified

January 9, 2023

📋 Description

All versions of url-relative are vulnerable to Denial of Service. If the values to and from are equal, the function hangs and never returns. This may cause a Denial of Service.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

🎯 Affected products1

npm/url-relative:<= 1.0.0

🔗 References (4)

https://github.com/junosuarez/url-relative/issues/3
https://www.npmjs.com/advisories/783
https://snyk.io/vuln/SNYK-JS-URLRELATIVE-173691
https://github.com/advisories/GHSA-86p3-4gfq-38f2