CVE-2021-43309 Vulnerability in npm package uri-template-lite

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method

Remediation

References

https://github.com/litejs/uri-template-lite/compare/v22.1.0...v22.9.0

https://research.jfrog.com/vulnerabilities/uri-template-lite-redos-xray-211351/

Related Vulnerabilities

CVE-2021-32573 Vulnerability in npm package express-cart

CVE-2021-21348 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2021-3503 Vulnerability in maven package org.wildfly:wildfly-metrics

CVE-2021-32623 Vulnerability in maven package org.opencastproject:opencast-kernel

CVE-2021-41165 Vulnerability in npm package ckeditor4

Severity

High

Classification

CWE-1333 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H