@eslint/plugin-kit Regular Expression Denial of Service Vulnerability
Summary
GHSA-xffm-g5w8-qvg7: The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument. Affects @eslint/plugin-kit versions < 0.3.4. Fixed in 0.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
@eslint/plugin-kit is a package that provides utilities for creating ESLint plugins. It simplifies the process of parsing configuration comments, allowing developers to define rules and configurations easily. However, it has a vulnerability that exposes it to Regular Expression Denial of Service (ReDoS) attacks, which can severely impact application performance.
Vulnerability Detail
The vulnerability lies in the ConfigCommentParser#parseJSONLikeConfig API, which is susceptible to a Regular Expression Denial of Service (ReDoS) attack. The regular expression used in this API is not anchored, leading to a quadratic runtime complexity when processing certain input strings. This can cause the application to hang indefinitely, resulting in high CPU usage and blocking execution. The specific line of code responsible for this issue can be found in the config-comment-parser.js file at line 158.
How To Fix
Latest published version: 0.7.3 as of 23 Oct 2026
npm install @eslint/plugin-kit@0.7.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.4
This is the first release that contains the fix.
npm install @eslint/plugin-kit@0.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the regular expression in the ConfigCommentParser#parseJSONLikeConfig method by prepending it with [^-a-zA-Z0-9/]. However, this is not a long-term solution and updating the package is recommended.
Conclusion
The @eslint/plugin-kit package has a critical vulnerability that can lead to Regular Expression Denial of Service attacks. It is essential to update to version 0.3.3 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor your application for such vulnerabilities in real-time.
See every vulnerability recorded for @eslint/plugin-kit →
FAQ
A ReDoS attack exploits the way certain regular expressions are processed, leading to excessive CPU usage and potentially causing the application to become unresponsive.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can identify if your application is affected. You can also check using the Vulert playground without signup.
If your application is affected, you may notice high CPU usage and unresponsive behavior when processing specific input strings with the vulnerable API.
While this vulnerability primarily affects application performance, it does not directly lead to data loss. However, it can disrupt normal operations and affect user experience.
If you cannot update the package right away, consider implementing the suggested workaround to modify the regular expression. However, plan to update to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for @eslint/plugin-kit.
