npm/html-parse-stringify2 CVE-2021-23346: medium 5.3, EPSS 2.13%
html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS)
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.0.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-545q-3fg6-48m7#npm/html-parse-stringify2
- https://nvd.nist.gov/vuln/detail/CVE-2021-23346
- https://github.com/HenrikJoreteg/html-parse-stringify/commit/c7274a48e59c92b2b7e906fedf9065159e73fe12
- https://github.com/HenrikJoreteg/html-parse-stringify/blob/master/lib/parse.js%23L2
- https://github.com/HenrikJoreteg/html-parse-stringify/releases/tag/v2.0.1
- https://github.com/rayd/html-parse-stringify2/blob/master/lib/parse.js%23L2
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1080633
- https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY-1079306
- https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307
CVE-2021-23346 · published · modified · JSON