CVE-2020-7753: Regular Expression Denial of Service in trim
Summary
CVE-2020-7753: Regular Expression Denial of Service in trim. Affects trim versions < 0.0.3. Fixed in 0.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'trim' package is an npm package that provides a utility function for trimming whitespace from strings. It is commonly used in JavaScript applications to remove leading and trailing spaces from user input or other string values. The package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its 'trim()' function. This vulnerability affects all versions of the package prior to version 0.0.3.
Vulnerability Detail
The Regular Expression Denial of Service (ReDoS) vulnerability in the 'trim' package allows an attacker to exploit the regular expression used in the 'trim()' function to cause a denial of service (DoS) condition. By providing a specially crafted input string, an attacker can trigger excessive backtracking in the regular expression engine, leading to a significant increase in CPU usage and potentially causing the application to become unresponsive. This vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 1.0.1 as of 23 Oct 2026
npm install trim@1.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.3
This is the first release that contains the fix.
npm install trim@0.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, developers can implement a workaround by manually modifying the 'trim()' function in their code. One possible workaround is to replace the regular expression used in the 'trim()' function with a simpler and more efficient implementation that does not suffer from the ReDoS vulnerability. Here is an example of a modified 'trim()' function:
function trim(str) {
return str.replace(/^\s+|\s+$/g, '');
}
Conclusion
The 'trim' package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its 'trim()' function. This vulnerability can be mitigated by upgrading to version 0.0.3 or later of the package. If immediate upgrade is not possible, developers can implement a workaround by modifying the 'trim()' function in their code. It is important to promptly address this vulnerability to prevent potential denial of service attacks. For further support or assistance, please contact DevNack.com.
See every vulnerability recorded for trim →
FAQ
This vulnerability allows an attacker to cause a denial of service (DoS) condition in applications that use the 'trim' package. By exploiting the ReDoS vulnerability, an attacker can consume excessive CPU resources, potentially leading to application slowdown or unresponsiveness.
To determine if your application is affected by this vulnerability, you can use the Vulert Playground at Vulert Scanner. Simply upload your package-lock.json file to the playground, and it will check if your application is vulnerable to this specific issue.
At the time of this report, there are no known public exploits specifically targeting this vulnerability in the 'trim' package. However, it is important to promptly address this vulnerability to mitigate the risk of potential future exploits.
While upgrading to the fixed version of the 'trim' package is the recommended solution, developers can implement a workaround by modifying the 'trim()' function in their code. The provided workaround replaces the vulnerable regular expression with a simpler implementation that avoids the ReDoS vulnerability.
For further support or assistance in addressing this vulnerability, you can contact info@devnack.com. The DevNack team can provide guidance on vulnerability remediation and answer any additional questions you may have.
