CVE-2021-23362: Regular Expression Denial of Service in hosted-git-info
Summary
CVE-2021-23362: Regular Expression Denial of Service in hosted-git-info. Affects hosted-git-info across 2 version ranges.
< 2.8.9
>= 3.0.0, < 3.0.8
Fixed in 2.8.9 or 3.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- node-hosted-git-info · Debian:11
The same CVE-2021-23362 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hosted-git-info package is an npm package used for retrieving information about hosted Git repositories. It provides functionality to parse and extract details such as the repository URL, owner, and branch. This package is commonly used in Node.js applications that interact with Git repositories. However, versions before 3.0.8 of hosted-git-info are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The vulnerability in hosted-git-info arises from a regular expression shortcutMatch in the fromUrl function in index.js. This regular expression exhibits polynomial worst-case time complexity, making it susceptible to ReDoS attacks. An attacker can exploit this vulnerability by providing a specially crafted URL, causing the regular expression to take an excessive amount of time to match. This can lead to a denial of service condition, where the application becomes unresponsive or consumes excessive resources. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3.
How To Fix
Latest published version: 10.1.1 as of 22 Oct 2026
npm install hosted-git-info@10.1.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.8.92.8.9npm install hosted-git-info@2.8.9 -
>= 3.0.0, < 3.0.83.0.8npm install hosted-git-info@3.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of hosted-git-info as mentioned above.
Conclusion
In conclusion, the hosted-git-info package before version 3.0.8 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. It is crucial to upgrade to the fixed versions mentioned above to mitigate this vulnerability and ensure the security and stability of your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for hosted-git-info →
FAQ
hosted-git-info is an npm package used for retrieving information about hosted Git repositories. It provides functionality to parse and extract details such as the repository URL, owner, and branch.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack that exploits the exponential time complexity of certain regular expressions. By providing a specially crafted input, an attacker can cause the regular expression matching to take an excessive amount of time, leading to a denial of service condition.
The vulnerability in hosted-git-info can lead to a denial of service condition in applications that use this package. This can result in the application becoming unresponsive or consuming excessive resources, impacting its availability and performance.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the package-lock.json file of your application, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
You can find more information about this vulnerability, including the specific versions affected and fixed, in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-43f8-2h32-f4cj/GHSA-43f8-2h32-f4cj.json.
