GoogleOSV:GHSA-J8XG-FQG3-53R7word-wrap vulnerable to Regular Expression Denial of Service
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
39.8%
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
References
github.com/jonschlinkert/word-wrap
github.com/jonschlinkert/word-wrap/blob/master/index.js#L39
github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39
github.com/jonschlinkert/word-wrap/commit/420dce9a2412b21881202b73a3c34f0edc53cb2e
github.com/jonschlinkert/word-wrap/releases/tag/1.2.4
nvd.nist.gov/vuln/detail/CVE-2023-26115
security.netapp.com/advisory/ntap-20240621-0006
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657
security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
39.8%