npm/html-minifier CVE-2022-37620: high 7.5, EPSS 1.35%
kangax html-minifier REDoS vulnerability
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 4.0.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-pfq8-rq6v-vf5m
- https://nvd.nist.gov/vuln/detail/CVE-2022-37620
- https://github.com/kangax/html-minifier/issues/1135
- https://github.com/kangax/html-minifier
- https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L1338
- https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L294
- https://security.snyk.io/vuln/SNYK-JS-HTMLMINIFIER-3091181
CVE-2022-37620 · published · modified · JSON