What is GHSA-h6ch-v84p-w6p9?

GHSA-h6ch-v84p-w6p9 is a security advisory published by GitHub Security Advisories with High severity. Regular Expression Denial of Service (ReDoS)

Why does GHSA-h6ch-v84p-w6p9 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-h6ch-v84p-w6p9?

GHSA-h6ch-v84p-w6p9 affects 1 product, including: npm/diff:\u003c 3.5.0.

GHSA-h6ch-v84p-w6p9HighDisclosed before NVD

Regular Expression Denial of Service (ReDoS)

Vendor

GitHub Security Advisories

Published

June 13, 2019

Last Modified

February 12, 2025

📋 Description

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

🎯 Affected products1

npm/diff:< 3.5.0

🔗 References (6)

https://github.com/kpdecker/jsdiff/commit/2aec4298639bf30fb88a00b356bf404d3551b8c0
https://bugzilla.redhat.com/show_bug.cgi?id=1552148
https://snyk.io/vuln/npm:diff:20180305
https://www.npmjs.com/advisories/1631
https://www.whitesourcesoftware.com/vulnerability-database/WS-2018-0590
https://github.com/advisories/GHSA-h6ch-v84p-w6p9