Asymmetric denial of service - ReDoS In nodejs
Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., {1..2..0}) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to expand() to ensure a step value of 0 is not used.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel8 | - | - | |
rpm rhel10 | - | - | |
rpm rhel9 | - | - | |
rpm rhel9 | - | - | |
 debian 14 | 2.0.3+~1.1.2-1 | ||
rpm rhel10 | - | - | |
rpm rhel10 | - | - | |
debian 13 | - | ||
rpm rhel8 | - | - | |
rpm rhel9 | - | - |
1-10 of 20
10
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10.