Skip to main content

Inefficient Regular Expression Complexity

CVE-2024-41818

High
7.5/10

Summary

The fast-xml-parser is an open-source, pure JavaScript XML parser. The package fast-xml-parser versions 4.3.5 through 4.4.0 are vulnerable to ReDOS existing on "currency.js".

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published