fix: v1 backport for CVE-2026-13149 - #122
Conversation
adam-tylr
changed the title
There was a problem hiding this comment.
The test in v5 didn't fail in v1. Seems that version isn't subject to the same blocking issue but still subject to a stack overflow with a large input
There was a problem hiding this comment.
also here, could you please mirror the original patch as close as possible? The more the release lines diverge, the harder it will be to backport further fixes
There was a problem hiding this comment.
I made a slight modification but since v1 is so different, the recursion test passed with just the switch to loop instead of recursion
juliangruber
left a comment
juliangruber
left a comment
There was a problem hiding this comment.
Verified against base and head: the v5 PoC completes instantly on v1, the base throws a catchable RangeError from ~3,000 comma joined {} groups, and the head returns correct output up to 50,000 groups. Differential fuzzing of base vs head across 400k inputs, with and without max, found no behavior changes.
The remaining post recursion overflow ('{a,b}'.repeat(3000) with max set) matches upstream 5.0.7 and can be closed by a future CVE-2026-14257 backport.
Two optional suggestions on the test below.
Updated GHSA-3jxr-9vmj-r5cp |
2 participants
Backports the 5.0.7 change to v1