GHSA-xfhp-gmh8-r8v2HighCVSS 7.5

printf vulnerable to Regular Expression Denial of Service (ReDoS)

Published
March 19, 2021
Last Modified
September 8, 2023

🔗 CVE IDs covered (1)

CVE-2021-23354 →

📋 Description

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string

/\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g

in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.

🎯 Affected products1

  • npm/printf:< 0.6.1

🔗 References (6)