CVE-2021-23354 | BDVDB-2026-150417 Detail

Description#

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12021-03-12Record published in the CVE List.
2. Version 22024-09-17Most recent update recorded in the CVE List.