Regular Expression Denial Of Service

2023-01-0904:25:17

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

luxon

regular expression denial of service

redos

regexparser.js

system crash

0.002 Low

EPSS

Percentile

61.1%

JSON

luxon is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability exists via the replace parameter in regexParser.js, which does not properly handle user-untrusted data allowing the attacker to supply arbitrary input to the function, resulting in a system crash.

CPENameOperatorVersion
luxonle1.28.0
luxonle2.4.0
luxonle3.1.0
luxonle1.28.0
luxonle3.2.0
luxonle2.5.1
luxonle1.28.0
luxonle2.4.0
luxonle3.1.0
luxonle1.28.0