Description

The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.

Remediation

References

https://snyk.io/vuln/SNYK-JS-PARSELINKHEADER-1582783

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2321973

https://github.com/thlorenz/parse-link-header/commit/72f05c717b3f129c5331a07bf300ed8886eb8ae1

Related Vulnerabilities

CVE-2019-5413 Vulnerability in npm package morgan

CVE-2022-28366 Vulnerability in maven package net.sourceforge.nekohtml:nekohtml

CVE-2022-24433 Vulnerability in npm package simple-git

CVE-2022-40705 Vulnerability in maven package soap:soap

CVE-2020-28478 Vulnerability in npm package gsap

Severity

High

Classification

CWE-1333 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Exploit Patch Third Party Advisory