Packages / react-native-reanimated / Security

HighVulnerabilityGHSA-2j79-8pqc-r7x6CVE-2022-24373Published 1 Oct 2022

react-native-reanimated vulnerable to ReDoS

Affected releases · react-native-reanimated

  • 2.x2.0.0 – 2.9.1Fixed in 2.10.0
  • 1.x1.0.0 – 1.13.4No fix on this line yet

On 2.x, the newest line:

npm install react-native-reanimated@2.10.0
4.x

  1. Not affected

    4.0.0 – 4.7.1

    34 releases, latest

2.x

  1. Affected

    2.0.0 – 2.9.1

    20 releases

  2. Fixed

    2.10.0 – 2.17.0

    12 releases

1.x

  1. Affected

    1.0.0 – 1.13.4

    24 releases

150 stable releases of react-native-reanimated, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-native-reanimated. It is read in your browser and sent nowhere.

What happens

The package react-native-reanimated before 2.10.0 is vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.