CVE-2026-73413

npm/shescape CVE-2026-73413: high, EPSS 0.59%

Shescape: Quadratic-time denial of service in the flag-protection

Action: Upgrade shescape to 2.1.14 or later.

npm i shescape@2.1.14

npm i shescape@3.0.1

Affected

Fixed versions

Sources

• osv: GHSA-gm3r-q2wp-hw87
• https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87
• https://github.com/ericcornelissen/shescape/pull/2649
• https://github.com/ericcornelissen/shescape/pull/2651
• https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de
• https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f
• https://github.com/ericcornelissen/shescape
• https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md
• https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14
• https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1

CVE-2026-73413 · published 2026-07-24T22:35:08Z · modified 2026-08-12T19:59:13.755299Z · JSON