Denial of Service Vulnerability in jsdiff Package
Summary
GHSA-73rr-hh4g-fpgx: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch. Affects diff across 3 version ranges.
< 4.0.4
>= 5.0.0, < 5.2.2
>= 6.0.0, < 8.0.3
Fixed in 4.0.4, 5.2.2 or 8.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsdiff package is a widely used library in the JavaScript ecosystem, primarily designed for computing differences between text files. It provides functionalities such as parsing patches and applying them to files, making it essential for version control and collaborative coding. However, it has been found to contain vulnerabilities that can lead to denial-of-service attacks, particularly when handling user-provided input.
Vulnerability Detail
The jsdiff package has a Denial of Service (DoS) vulnerability in its parsePatch and applyPatch methods. When a patch with specific line break characters (\r, \u2028, or \u2029) is parsed, the parsePatch method can enter an infinite loop, consuming memory until the process crashes. This vulnerability can be exploited by attackers who control input to the parsePatch method, allowing them to cause a DoS without needing a large payload. Additionally, a lesser ReDOS vulnerability can occur if these characters are present in a patch's header, leading to significant delays in processing time.
How To Fix
Latest published version: 9.0.0 as of 22 Oct 2026
npm install diff@9.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.0.44.0.4npm install diff@4.0.4 -
>= 5.0.0, < 5.2.25.2.2npm install diff@5.2.2 -
>= 6.0.0, < 8.0.38.0.3npm install diff@8.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot update to the patched version, avoid parsing patches that contain the characters \r, \u2028, or \u2029. Implement input validation to sanitize user-provided patches before processing them.
Conclusion
The jsdiff package has a critical Denial of Service vulnerability that can be exploited through malicious input. It is essential to update to the latest patched version to mitigate this risk. If updating is not feasible, ensure to implement workarounds to protect your application.
See every vulnerability recorded for diff →
FAQ
The vulnerability has a CVSS score of 2.7, indicating a low severity level.
Yes, an attacker can exploit this vulnerability remotely by providing malicious input to the parsePatch method.
Versions of jsdiff prior to 8.0.3, 5.2.2, and 4.0.4 are affected by this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If immediate updates are not possible, implement input validation to prevent parsing of malicious patches containing the specified line break characters.
References
Related vulnerabilities
Recent vulnerabilities recorded for diff.
