Regular Expression Denial of Service in esm
Summary
GHSA-qx4v-6gc5-f2vv: Regular Expression Denial of Service. Affects esm versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The esm package is an npm package that provides ECMAScript module loader implementation. It allows developers to use ES modules in Node.js. The package is widely used in JavaScript projects to enable the use of modern JavaScript syntax and features. However, a vulnerability has been discovered in esm before version 3.1.0.
Vulnerability Detail
The vulnerability in esm is a Regular Expression Denial of Service (ReDoS) issue. The find-indexes function in esm uses unescaped identifiers in a regular expression, which can lead to an infinite loop. An attacker can exploit this vulnerability by providing specially crafted input that triggers the infinite loop, causing a denial of service condition. This can result in resource exhaustion and impact the availability of the affected application.
How To Fix
Minimum fixed version
3.1.0
This is the first release that contains the fix.
npm install esm@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the esm package to the fixed version.
Conclusion
The esm package before version 3.1.0 is vulnerable to a Regular Expression Denial of Service (ReDoS) issue. It is recommended to update the package to the fixed version to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for esm →
FAQ
esm is an npm package that provides ECMAScript module loader implementation for Node.js.
A Regular Expression Denial of Service (ReDoS) vulnerability occurs when a regular expression pattern can be exploited to cause a denial of service condition by triggering an infinite loop.
An attacker can exploit this vulnerability by providing specially crafted input that triggers the infinite loop in the esm package, causing a denial of service condition.
The vulnerability can lead to resource exhaustion and impact the availability of the affected application.
To fix this vulnerability, update the esm package to version 3.1.0 or later.
