Most recent entries from all

EUVD-2026-6441

fkie_cve-2024-41655

TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.

GHSA-8h55-q5qq-p685 — (ReDoS) Regular Expression Denial of Service in tf2-item-format

Affected: npm: tf2-item-format

## Summary

Versions of `tf2-item-format` since at least `4.2.6` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input.

## Tested Versions

- `5.9.13` - `5.8.10` - `5.7.0` - `5.6.17` - `4.3.5` - `4.2.6`

### v5 Upgrade package to `^5.9.14`

### v4 No patch exists. Please consult the [v4 to v5 migration guide](https://github.com/danocmx/node-tf2-item-format?tab=readme-ov-file#migrating-from-v4-to-v5) to upgrade to v5.

If upgrading to v5 is not possible, fork the module repository and implement the fix detailed below.

## Impact

This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input.