CVE-2022-1929: Regular Expression Denial of Service in devcert
Summary
CVE-2022-1929: Regular expression denial of service in devcert. Affects devcert versions < 1.2.1. Fixed in 1.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
devcert is an npm package that provides a convenient way to generate and manage SSL/TLS certificates for development purposes. It is commonly used by developers to enable HTTPS on local development environments. The package offers a certificateFor method that allows users to generate certificates. However, a vulnerability has been discovered in devcert that can lead to a denial of service (DoS) attack when an attacker is able to supply arbitrary input to the certificateFor method.
Vulnerability Detail
The vulnerability in devcert is an exponential ReDoS (Regular Expression Denial of Service) issue. This type of vulnerability occurs when a regular expression pattern is susceptible to excessive backtracking, leading to a significant slowdown or even a complete freeze of the application. In the case of devcert, an attacker can exploit this vulnerability by providing specially crafted input to the certificateFor method, causing the application to consume excessive CPU resources and potentially become unresponsive. This can result in a denial of service, impacting the availability of the affected application.
How To Fix
Latest published version: 1.2.3 as of 23 Oct 2026
npm install devcert@1.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.1
This is the first release that contains the fix.
npm install devcert@1.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of devcert as soon as possible.
Conclusion
The devcert package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. It is crucial for developers to update to the latest version of devcert (1.2.1 or later) to mitigate the risk of a denial of service. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for devcert →
FAQ
devcert is an npm package that provides SSL/TLS certificate generation and management for development environments.
A ReDoS attack occurs when a regular expression pattern can be exploited to cause excessive backtracking, leading to a denial of service.
An attacker can exploit this vulnerability by providing specially crafted input to the certificateFor method in devcert, causing excessive CPU usage and potentially a denial of service.
The vulnerability can result in a denial of service, impacting the availability of the affected application.
To fix this vulnerability, update the devcert package to version 1.2.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for devcert.
