Skip to content

Regular Expression Denial of Service in Acorn

High severity GitHub Reviewed Published Apr 3, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm acorn (npm)

Affected versions

>= 6.0.0, < 6.4.1
>= 7.0.0, < 7.1.1
>= 5.5.0, < 5.7.4

Patched versions

6.4.1
7.1.1
5.7.4

Description

Affected versions of acorn are vulnerable to Regular Expression Denial of Service.
A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop.
The string is not valid UTF16 which usually results in it being sanitized before reaching the parser.
If an application processes untrusted input and passes it directly to acorn,
attackers may leverage the vulnerability leading to Denial of Service.

References

Last updated Jan 9, 2023
Published to the GitHub Advisory Database Apr 3, 2020
Reviewed Apr 3, 2020

Severity

High
7.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-6chw-6frg-f759

Source code

No known source code
Checking history
See something to contribute? Suggest improvements for this vulnerability.