What is GHSA-qx4v-6gc5-f2vv?

GHSA-qx4v-6gc5-f2vv is a security advisory published by GitHub Security Advisories with Medium severity. Regular Expression Denial of Service

Why does GHSA-qx4v-6gc5-f2vv have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-qx4v-6gc5-f2vv?

GHSA-qx4v-6gc5-f2vv affects 1 product, including: npm/esm:\u003c 3.1.0.

GHSA-qx4v-6gc5-f2vvMediumDisclosed before NVD

Regular Expression Denial of Service

Vendor

GitHub Security Advisories

Published

June 20, 2019

Last Modified

January 9, 2023

📋 Description

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.

🎯 Affected products1

npm/esm:< 3.1.0

🔗 References (3)

https://github.com/standard-things/esm/issues/694
https://github.com/standard-things/esm/commit/c41e001d81a5a52b0d2d1722b1c2af04d997c05b
https://github.com/advisories/GHSA-qx4v-6gc5-f2vv