CVE-2024-21539: Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
Summary
CVE-2024-21539: Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit. Affects @eslint/plugin-kit versions < 0.2.3. Fixed in 0.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @eslint/plugin-kit package is a utility library designed to assist in the development of ESLint plugins. It provides tools for parsing configuration comments and managing plugin configurations effectively. However, due to its reliance on regular expressions for parsing, it is susceptible to performance issues when faced with specially crafted input strings, leading to potential Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from the use of inefficient regular expressions within the ConfigCommentParser class of the @eslint/plugin-kit package. An attacker can exploit this by crafting a very large input string that causes excessive CPU usage, potentially crashing the application or rendering it unresponsive. This type of attack is known as Regular Expression Denial of Service (ReDoS), which can severely impact the performance of applications utilizing this package.
How To Fix
Latest published version: 0.7.3 as of 23 Oct 2026
npm install @eslint/plugin-kit@0.7.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.3
This is the first release that contains the fix.
npm install @eslint/plugin-kit@0.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the ConfigCommentParser with large or specially crafted input strings. Implement input validation to limit the size and complexity of strings processed by the parser. Here is an example of how to limit input size:
const MAX_INPUT_LENGTH = 10000;
if (str.length > MAX_INPUT_LENGTH) {
throw new Error('Input string is too large.');
}
Conclusion
The CVE-2024-21539 vulnerability in the @eslint/plugin-kit package poses a significant risk due to its potential for causing Denial of Service attacks through crafted input strings. It is crucial to update to the latest version to mitigate this risk and ensure the stability of your applications.
See every vulnerability recorded for @eslint/plugin-kit →
FAQ
CVE-2024-21539 is a vulnerability in the @eslint/plugin-kit package that allows for Regular Expression Denial of Service (ReDoS) attacks due to inefficient regex handling.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without any signup.
Exploiting this vulnerability can lead to high CPU usage, application crashes, and denial of service, affecting the availability of your application.
Yes, a patch is available in version 0.2.3 of the @eslint/plugin-kit package. Updating to this version will resolve the vulnerability.
If you cannot update immediately, implement input validation to restrict the size and complexity of strings processed by the ConfigCommentParser as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for @eslint/plugin-kit.
