high7.5
CVE-2021-23392
Uncontrolled Resource Consumption in locutus
Impact
The package locutus before 2.0.15 is vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | locutus | < 2.0.15 | 2.0.15 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Locutus | Locutus | before 2.0.15 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/locutusjs/locutus/commit/eb863321990e7e5514aa14f68b8d9978ece9e65e
- https://github.com/locutusjs/locutus/pull/446
- https://snyk.io/vuln/SNYK-JS-LOCUTUS-1090597
- https://github.com/advisories/GHSA-39q4-p535-c852
- https://nvd.nist.gov/vuln/detail/CVE-2021-23392