npm/shescape CVE-2026-73413: high, EPSS 0.59%
Shescape: Quadratic-time denial of service in the flag-protection
Action: Upgrade shescape to 2.1.14 or later.
npm i shescape@2.1.14npm i shescape@3.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.1.11 | 2.1.14 | - |
| 3.0.0 | 3.0.1 | - |
Fixed versions
| 2.1.14 | 3.0.1 |
Sources
- osv: GHSA-gm3r-q2wp-hw87
- https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87
- https://github.com/ericcornelissen/shescape/pull/2649
- https://github.com/ericcornelissen/shescape/pull/2651
- https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de
- https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f
- https://github.com/ericcornelissen/shescape
- https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md
- https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14
- https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1
CVE-2026-73413 · published · modified · JSON