CVE-2019-20922 Regular Expression Denial of Service in Handlebars
Attackers can cause resource exhaustion and service disruption in applications using Handlebars by submitting crafted templates that trigger excessive regex processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-20922?
CVE-2019-20922 is a high-severity denial of service vulnerability in n/a, published on 30 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
Weakness: CWE-400
Which versions are affected by CVE-2019-20922?
2 open source packages ship an affected version, including handlebars. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
handlebars npm | From 4.0.0 | 4.4.5 |
handlebars npm | From 4.0.0 | 4.4.5 |
Products include Handlebarsjs Handlebars.
How do I fix CVE-2019-20922?
Upgrade handlebars to 4.4.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-20922 being exploited?
There is no known exploitation of CVE-2019-20922 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion
- CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
- CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
- CVE-2026-33940 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
- CVE-2019-20920 Arbitrary Code Execution in Handlebars
Sources
Also known as GHSA-62gr-4qp9-h98f, SNYK-JS-HANDLEBARS-480388, UBUNTU-CVE-2019-20922.