CVE-2020-7661 Regular expression denial of service in url-regex
An attacker can cause a Denial of Service by providing a very long string to the url-regex library, affecting applications using this npm package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7661?
CVE-2020-7661 is a high-severity denial of service vulnerability in url-regex, published on 4 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.
Weakness: CWE-400
Which versions are affected by CVE-2020-7661?
2 open source packages ship an affected version, including url-regex. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
url-regex npm | All versions to 5.0.0 | None |
url-regex npm | All versions to 5.0.0 | None |
Products include Url-Regex Project Url-Regex.
How do I fix CVE-2020-7661?
No fix has been published for CVE-2020-7661 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-7661 being exploited?
There is no known exploitation of CVE-2020-7661 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in url-regex
Sources
Also known as GHSA-v4rh-8p82-6h5w.