https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T03:38:29.269136+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-6441 EUVD-2026-6441 2026-10-08T03:38:29.323236+00:00 EUVD-2026-6441 https://cve.radiocsirt.org/vuln/fkie_cve-2024-41655 fkie_cve-2024-41655 2026-10-08T03:38:29.323282+00:00

TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-8h55-q5qq-p685 GHSA-8h55-q5qq-p685 — (ReDoS) Regular Expression Denial of Service in tf2-item-format 2026-10-08T03:38:29.323321+00:00

Affected: npm: tf2-item-format

## Summary

Versions of `tf2-item-format` since at least `4.2.6` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input.

## Tested Versions

- `5.9.13` - `5.8.10` - `5.7.0` - `5.6.17` - `4.3.5` - `4.2.6`

### v5 Upgrade package to `^5.9.14`

### v4 No patch exists. Please consult the [v4 to v5 migration guide](https://github.com/danocmx/node-tf2-item-format?tab=readme-ov-file#migrating-from-v4-to-v5) to upgrade to v5.

If upgrading to v5 is not possible, fork the module repository and implement the fix detailed below.

## Impact

This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input.