CVE-2024-9506: ReDoS Vulnerability in Vue Package Due to Inefficient Regex Evaluation
Summary
CVE-2024-9506: The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. Affects vue versions >= 2.0.0-alpha.1, < 3.0.0-alpha.0. Fixed in 3.0.0-alpha.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vue is a progressive JavaScript framework used for building user interfaces and single-page applications. It is designed to be incrementally adoptable, allowing developers to integrate it into projects without extensive rewrites. Vue's core features include a reactive data binding system, a component-based architecture, and a virtual DOM for efficient rendering. However, the framework is susceptible to a ReDoS (Regular Expression Denial of Service) vulnerability in its parseHTML function, which can lead to performance degradation when processing certain inputs.
Vulnerability Detail
The ReDoS vulnerability in the Vue package arises from the parseHTML function located in the html-parser.ts file. This flaw allows attackers to exploit inefficient regular expression evaluations by providing specially crafted input, which can cause excessive resource consumption and slow down the application significantly. For instance, if a user inputs a template string with a malformed <script> tag, the application may take an inordinate amount of time to parse and mount, demonstrating the potential for denial of service.
How To Fix
Latest published version: 3.5.44 as of 23 Oct 2026
npm install vue@3.5.44Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0-alpha.0
This is the first release that contains the fix.
npm install vue@3.0.0-alpha.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using potentially malicious input in template strings. For example, ensure that any user-generated content is sanitized and does not include malformed HTML tags that could trigger the vulnerability. Here is an example of a safe Vue instance:
new Vue({
el: '#app',
template: '<div>Hello, world!</div>'
});
Conclusion
The ReDoS vulnerability in the Vue package poses a risk to applications that utilize inefficient regex evaluations in the parseHTML function. Developers are encouraged to update to the patched version of Vue to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for vue →
FAQ
A ReDoS (Regular Expression Denial of Service) vulnerability occurs when an application is vulnerable to slowdowns caused by inefficient regular expression evaluations, often leading to excessive resource consumption.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner without signing up.
The vulnerability affects Vue versions starting from 2.0.0-alpha.1 and is fixed in version 3.0.0-alpha.0.
If you cannot update Vue immediately, ensure that you sanitize any user-generated content to prevent the injection of malicious input that could exploit the vulnerability.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
