npm/html-parse-stringify CVE-2021-23346: medium 5.3, EPSS 2.13%
html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS)
Action: Upgrade html-parse-stringify to 2.0.1 or later.
npm i html-parse-stringify@2.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.1 | - |
Fixed versions
| 2.0.1 |
Sources
- osv: GHSA-545q-3fg6-48m7
- https://nvd.nist.gov/vuln/detail/CVE-2021-23346
- https://github.com/HenrikJoreteg/html-parse-stringify/commit/c7274a48e59c92b2b7e906fedf9065159e73fe12
- https://github.com/HenrikJoreteg/html-parse-stringify/blob/master/lib/parse.js%23L2
- https://github.com/HenrikJoreteg/html-parse-stringify/releases/tag/v2.0.1
- https://github.com/rayd/html-parse-stringify2/blob/master/lib/parse.js%23L2
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1080633
- https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY-1079306
- https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307
CVE-2021-23346 · published · modified · JSON