This repository was archived by the owner on Feb 17, 2022. It is now read-only.
This repository was archived by the owner on Feb 17, 2022. It is now read-only.
Regular Expression Denial of Service (ReDoS) #12
Description
Regular Expression Denial of Service (ReDoS)
Vulnerable module: diff
Introduced through: mocha@3.5.3
Detailed paths
Introduced through: firstbloodtoken@Firstbloodio/token#ae71053e0656b0ceba7e229e1d67c09f271191dc › mocha@3.5.3 › diff@3.2.0
Remediation: Upgrade to mocha@5.0.3.
Overview
diff is a javascript text differencing implementation.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This can cause an impact of about 10 seconds matching time for data 48K characters long.