GHSA-62gr-4qp9-h98f

ghsaUSosv

Regular Expression Denial of Service in Handlebars

view advisory published 2022-02-10Licence: CC-BY-4.0

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-20922US	high7.5	3.69% (90th)	—	2020-09-30
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templa…

references

External citations — patches, advisories, analysis.

https://github.com/handlebars-lang/handlebars.js/commit/8d5530ee2c3ea9f0aee3fde310b9f36887d00b8bWEB
https://nvd.nist.gov/vuln/detail/CVE-2019-20922ADVISORY
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-480388WEB
https://www.npmjs.com/advisories/1300WEB
https://www.npmjs.com/package/handlebarsWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan