CVE-2023-26115: word-wrap vulnerable to Regular Expression Denial of Service
Summary
CVE-2023-26115: word-wrap vulnerable to Regular Expression Denial of Service. Affects word-wrap versions < 1.2.4. Fixed in 1.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The word-wrap package is an npm package that provides a utility function for wrapping text to a specified width. It is commonly used in JavaScript applications to format text output. The package is vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
Vulnerability Detail
The vulnerability in word-wrap arises from the insecure regular expression used in the result variable. This can be exploited by an attacker to cause a denial of service (DoS) attack by providing specially crafted input that triggers excessive backtracking in the regular expression engine. This can lead to the application becoming unresponsive or crashing. The severity of this vulnerability is moderate, with a CVSS score of 5.3.
How To Fix
Latest published version: 1.2.5 as of 22 Oct 2026
npm install word-wrap@1.2.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.4
This is the first release that contains the fix.
npm install word-wrap@1.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
The word-wrap package is vulnerable to Regular Expression Denial of Service (ReDoS) due to an insecure regular expression. It is recommended to update the package to version 1.2.4 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for word-wrap →
FAQ
word-wrap is an npm package that provides a utility function for wrapping text to a specified width. It is commonly used in JavaScript applications to format text output.
Regular Expression Denial of Service (ReDoS) is a type of denial of service attack that targets applications using regular expressions. It exploits the exponential time complexity of certain regular expressions to cause the application to become unresponsive or crash.
This vulnerability can be exploited by an attacker to cause a denial of service (DoS) attack by providing specially crafted input that triggers excessive backtracking in the regular expression engine. This can lead to the application becoming unresponsive or crashing.
The severity of this vulnerability is moderate, with a CVSS score of 5.3.
To fix this vulnerability, it is recommended to update the word-wrap package to version 1.2.4 or later. This version includes a fix for the insecure regular expression. Developers can update the package by running the following command in their project directory: npm install word-wrap@1.2.4
