{"id":"GHSA-v2p6-4mp7-3r9v","summary":"Regular Expression Denial of Service in underscore.string","details":"Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS).\n\nThe function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.\n\n\n## Recommendation\n\nUpgrade to version 3.3.5 or higher.","modified":"2020-08-31T18:34:16Z","published":"2019-06-14T16:26:22Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2019-06-14T16:24:01Z","nvd_published_at":null,"cwe_ids":["CWE-400"]},"references":[{"type":"WEB","url":"https://github.com/epeli/underscore.string/issues/510"},{"type":"WEB","url":"https://github.com/epeli/underscore.string/pull/517"},{"type":"WEB","url":"https://github.com/epeli/underscore.string/commit/f486cd684c94c12db48b45d52b1472a1b9661029"},{"type":"WEB","url":"https://www.npmjs.com/advisories/745"}],"affected":[{"package":{"name":"underscore.string","ecosystem":"npm","purl":"pkg:npm/underscore.string"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-v2p6-4mp7-3r9v/GHSA-v2p6-4mp7-3r9v.json"}}],"schema_version":"1.9.0"}