Packages / hosted-git-info / Security

ModerateVulnerabilityGHSA-43f8-2h32-f4cjCVE-2021-23362Published 6 May 2021

Regular Expression Denial of Service in hosted-git-info

Your version

Affected releases · hosted-git-info

  • 3.x3.0.0 – 3.0.7Fixed in 3.0.8
  • 2.x2.0.0 – 2.8.8Fixed in 2.8.9
  • 1.x1.0.0 – 1.6.0No fix on this line yet

On 3.x, the newest line:

npm install hosted-git-info@3.0.8
Every release on a timeline
10.x

  1. Not affected

    10.0.0 – 10.1.1

    3 releases, latest

3.x

  1. Affected

    3.0.0 – 3.0.7

    8 releases

  2. Fixed

    3.0.8

    1 release

2.x

  1. Affected

    2.0.0 – 2.8.8

    31 releases

  2. Fixed

    2.8.9

    1 release

1.x

  1. Affected

    1.0.0 – 1.6.0

    10 releases

78 stable releases of hosted-git-info, oldest to newest, one row per major.

What happens

The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity