HIGH7.5

GHSA-fp36-299x-pwmw

Regular expression denial of service in devcert

Quick fix

GHSA-fp36-299x-pwmw — devcert: upgrade to the fixed version with the command below.

npm install devcert@1.2.1

Details

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/devcert

Introduced in: 0Fixed in: 1.2.1

Fixnpm install devcert@1.2.1

References

https://nvd.nist.gov/vuln/detail/CVE-2022-1929[ADVISORY]
https://github.com/davewasmer/devcert/commit/b0763215f6683271d296fda98f7ef7bcd4a55977[WEB]
https://github.com/davewasmer/devcert[PACKAGE]
https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352[WEB]