CVE-2023-26115 word-wrap vulnerable to Regular Expression Denial of Service
Attackers can cause denial of service in applications using the word-wrap library by triggering inefficient regular expression processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26115?
CVE-2023-26115 is a medium-severity denial of service vulnerability in org.webjars.npm:word-wrap, published on 22 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
Weakness: CWE-1333
Which versions are affected by CVE-2023-26115?
2 open source packages ship an affected version, including word-wrap. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
word-wrap npm | All versions | 1.2.4 |
word-wrap npm | All versions | 1.2.4 |
Products include Word-Wrap Project Word-Wrap.
How do I fix CVE-2023-26115?
Upgrade word-wrap to 1.2.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-26115 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26115 exists.
Sources
Also known as AZL-43867, AZL-44184, CLSA-2026-1782954036, GHSA-j8xg-fqg3-53r7, MINI-hj27-vwh8-3gjj, ROOT-APP-NPM-CVE-2023-26115.