GHSA-jxqq-cqm6-pfq9Medium

Regular Expression Denial of Service in slug

Published
July 24, 2018
Last Modified
January 12, 2023

🔗 CVE IDs covered (1)

📋 Description

Affected versions of slug are vulnerable to a regular expression denial of service when parsing untrusted user input.

The issue is low severity, as it takes 50,000 characters to cause the event loop to block for 2 seconds,

About 50k characters can block the event loop for 2 seconds.

Recommendation

Update to version 0.9.2 or later.

🎯 Affected products1

  • npm/slug:<= 0.9.1

🔗 References (4)