ReDoS in normalize-url
High severity
GitHub Reviewed
Published
Jun 8, 2021
to the GitHub Advisory Database
•
Updated Nov 29, 2023
Package
Affected versions
>= 5.0.0, < 5.3.1
>= 6.0.0, < 6.0.1
>= 4.3.0, < 4.5.1
Patched versions
5.3.1
6.0.1
4.5.1
Description
Published by the National Vulnerability Database
May 24, 2021
Reviewed
May 28, 2021
Published to the GitHub Advisory Database
Jun 8, 2021
Last updated
Nov 29, 2023
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
References