Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Vulnerability] Passing a long string to the url-regex library is resulting in 100% CPU usage #59

Closed
fx2000 opened this issue Jul 25, 2020 · 3 comments · Fixed by #64
Closed

Comments

@fx2000
Copy link
Contributor

fx2000 commented Jul 25, 2020

No way out but a SIGINT, you can read more about it here and here. I can confirm get-urls is affected.

@justinlazaro-iselect
Copy link

hopefully, there's an update about on this

@niftylettuce
Copy link

I'm the original author that found this vulnerability, and have released https://github.com/niftylettuce/url-regex-safe as the fix.

@fx2000
Copy link
Contributor Author

fx2000 commented Aug 17, 2020

I'm the original author that found this vulnerability, and have released https://github.com/niftylettuce/url-regex-safe as the fix.

Excellent. I replaced "url-regex" with "url-regex-safe" and create a PR for this change. Minimum node version needs to be updated to 10.12.0 for this to work though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants