Inefficient Regular Expression Complexity Affecting nodejs-nodemon package, versions <0:2.0.3-1.module+el8.3.0+7818+6cd30d85


Severity

Recommended
0.0
medium
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.24% (62nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Inefficient Regular Expression Complexity vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ORACLE8-NODEJSNODEMON-2587267
  • published10 Apr 2022
  • disclosed23 Mar 2021

Introduced: 23 Mar 2021

CVE-2021-23362  (opens in a new tab)
CWE-1333  (opens in a new tab)

How to fix?

Upgrade Oracle:8 nodejs-nodemon to version 0:2.0.3-1.module+el8.3.0+7818+6cd30d85 or higher.
This issue was patched in ELSA-2021-3074.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs-nodemon package and not the nodejs-nodemon package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

CVSS Scores

version 3.1