MEDIUM5.3

GHSA-p2c4-gxp4-j3xp

Denial of service in Valine

Details

Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/valine

Introduced in: 0

No fixed version published yet for valine (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-34801[ADVISORY]
https://github.com/xCss/Valine/issues/366[WEB]
https://github.com/xCss/Valine[PACKAGE]