---
title: "GHSA-43f8-2h32-f4cj: Regular Expression Denial of Service in hosted-git-info"
description: "Moderate severity. Regular Expression Denial of Service in hosted-git-info. Affects hosted-git-info; fixed in 3.0.8."
url: https://inlinr.com/advisories/GHSA-43f8-2h32-f4cj
lang: en
---

[Packages](https://inlinr.com/packages) / [hosted-git-info](https://inlinr.com/packages/hosted-git-info) / [Security](https://inlinr.com/packages/hosted-git-info/security)

Moderate Vulnerability GHSA-43f8-2h32-f4cj CVE-2021-23362 Published 6 May 2021

# Regular Expression Denial of Service in hosted-git-info

Your version 

Affected releases · [hosted-git-info](https://inlinr.com/packages/hosted-git-info)

- 3.x 3.0.0 – 3.0.7 Fixed in 3.0.8
- 2.x 2.0.0 – 2.8.8 Fixed in 2.8.9
- 1.x 1.0.0 – 1.6.0 No fix on this line yet

On 3.x, the newest line:

```
npm install hosted-git-info@3.0.8
```

Every release on a timeline

10.x 

1. Not affected

10.0.0 – 10.1.1  
3 releases, latest

3.x 

1. Affected

3.0.0 – 3.0.7  
8 releases
2. Fixed

3.0.8  
1 release

2.x 

1. Affected

2.0.0 – 2.8.8  
31 releases
2. Fixed

2.8.9  
1 release

1.x 

1. Affected

1.0.0 – 1.6.0  
10 releases

78 stable releases of hosted-git-info, oldest to newest, one row per major.

## What happens

The npm package `hosted-git-info` before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:L

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-23362 "https://nvd.nist.gov/vuln/detail/CVE-2021-23362")  
nvd.nist.gov/vuln/detail/CVE-2021-23362
- [Pull request](https://github.com/npm/hosted-git-info/pull/76 "https://github.com/npm/hosted-git-info/pull/76")  
#76
- [Fix commit](https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7 "https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7")  
29adfe5
- [Fix commit](https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01 "https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01")  
8d4b369
- [Fix commit](https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3 "https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3")  
bede0dc
- [Reference](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf")  
cert-portal.siemens.com/productcert/pdf/ssa-389…
- [Package](https://github.com/npm/hosted-git-info "https://github.com/npm/hosted-git-info")  
github.com/npm/hosted-git-info
- [Reference](https://github.com/npm/hosted-git-info/commits/v2 "https://github.com/npm/hosted-git-info/commits/v2")  
github.com/npm/hosted-git-info/commits/v2
- [Reference](https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356 "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356")  
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
- [Reference](https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 "https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355")  
snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355