Security vulnerabilities and automated fixes for redos issues
10 posts found
CVE-2021-33623 exposed a Regular Expression Denial of Service (ReDoS) vulnerability in the npm package `trim-newlines` versions 1.0.0 and earlier. The vulnerable `.end()` method used an inefficient regex pattern that could cause severe performance degradation when processing malicious input. Upgrading to version 4.0.1 patches the regex implementation and eliminates the attack surface.
CVE-2024-4068 is a high-severity Regular Expression Denial of Service (ReDoS) vulnerability in the `braces` npm package (versions prior to 3.0.3) that allows an attacker to trigger catastrophic CPU consumption by supplying a crafted brace-expansion string with no character limit. The fix upgrades `braces` from 3.0.2 to 3.0.3 and its internal dependency `fill-range` from 7.0.1 to 7.1.1, both of which enforce limits on the size of input they will process. This patch was applied via a Yarn resoluti
CVE-2026-4867 is a Regular Expression Denial of Service (ReDoS) vulnerability in the `path-to-regexp` package (versions prior to 0.1.13) that allows an attacker to craft malformed URL parameters that cause catastrophic backtracking in the regex engine, effectively hanging the Node.js event loop. The fix upgrades `path-to-regexp` from 0.1.12 to 0.1.13 and pins the version via an `overrides` field in `package.json` to ensure the patched version is used throughout the entire dependency tree. Any Ex
CVE-2024-52798 is a Regular Expression Denial of Service (ReDoS) vulnerability in the `path-to-regexp` package's 0.1.x branch, which remains unpatched in that legacy line. Because `path-to-regexp` is a transitive dependency pulled in by `websocket-driver` and many other popular Node.js packages, any application that processes attacker-controlled URL paths through an affected version is at risk of catastrophic backtracking that can freeze the event loop. Upgrading `websocket-driver` to 0.7.5 — an
CVE-2026-33671 is a Regular Expression Denial of Service (ReDoS) vulnerability in the picomatch glob-matching library, triggered by specially crafted extglob patterns that cause catastrophic regex backtracking. The fix upgrades picomatch to version 4.0.4 (with overrides pinning all transitive copies) in the client's dependency tree, eliminating the vulnerable regex evaluation path. Left unpatched, any code path that passes user-influenced glob patterns to picomatch could be weaponized to stall a
A high-severity denial of service vulnerability in the `path-to-regexp` package (CVE-2026-4926) could allow attackers to craft malicious regular expressions that consume excessive CPU resources. The fix upgrades from version 8.2.0 to 8.4.0, which hardens regex handling and prevents ReDoS (Regular Expression Denial of Service) attacks in Express applications.
A critical vulnerability in `roll/openai.js` could expose OpenAI API keys to client-side JavaScript bundles, allowing attackers to extract secrets from browser developer tools. Additionally, a Regular Expression Denial of Service (ReDoS) pattern in the `generateErrorMessage()` method could crash the process. Both issues were fixed with targeted, minimal code changes.
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in Anthropic's Model Context Protocol (MCP) TypeScript SDK version 1.24.0. This high-severity flaw (CVE-2026-0621) could allow attackers to craft malicious input that causes catastrophic regex backtracking, freezing the Node.js event loop. The fix involves upgrading to @modelcontextprotocol/sdk version 1.25.2, which patches the vulnerable regex patterns.
A Regular Expression Denial of Service (ReDoS) vulnerability in picomatch versions prior to 2.3.2, 3.0.2, and 4.0.4 allowed attackers to craft malicious extglob patterns that triggered catastrophic backtracking in the regex engine, potentially freezing Node.js applications. The fix, tracked as CVE-2026-33671, involved upgrading picomatch to patched versions and pinning the dependency explicitly in `package.json` to ensure the safe version is resolved across the dependency tree.
A high-severity Regular Expression Denial of Service (ReDoS) vulnerability was discovered and patched in Nushell's interactive TUI explorer, where unvalidated user keystrokes could be passed directly into regex compilation, allowing adversarial inputs to consume 100% CPU and freeze the interface. This fix adds proper input validation and length limits to the search input handler, preventing catastrophic backtracking attacks. Understanding this vulnerability is essential for any developer buildin