CVE-2022-36034
Polynomial regular expression used on uncontrolled data in nitrado.js
Impact
### Impact Possible ReDoS with lib input of `{{` and with many repetitions of `{{|` ### Patches Patched in all versions above `0.2.5` ### Workarounds No known work arounds. ### References - OWASP: [Regular expression Denial of Service - ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS) - Wikipedia: [ReDoS](https://en.wikipedia.org/wiki/ReDoS). - Wikipedia: [Time complexity](https://en.wikipedia.org/wiki/Time_complexity). - James Kirrage, Asiri Rathnayake, Hayo Thielecke: [Static Analysis for Regular Expression Denial-of-Service Attack](http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf). - Common Weakness Enumeration: [CWE-1333](https://cwe.mitre.org/data/definitions/1333.html). - Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | nitrado.js | < 0.2.5 | 0.2.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nitrado.Js Project | Nitrado.Js | before 0.2.5 |