Description (CNA)
The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / printf | affected unspecified before 0.6.1 |
CWE
No CWE identifiers supplied.
References
- https://snyk.io/vuln/SNYK-JS-PRINTF-1072096
- https://github.com/adaltas/node-printf/pull/32
- https://github.com/adaltas/node-printf/issues/31
ADP enrichment
No English description supplied.