Packages / react-native / Security

HighVulnerabilityGHSA-7f53-fmmv-mfjvCVE-2020-1920Published 20 Jul 2021

Regular expression denial of service in react-native

Affected releases · react-native

  • 0.64.x0.64.0Fixed in 0.64.1
  • 0.63.x0.63.0 – 0.63.5No fix on this line yet
  • 0.62.x0.62.0 – 0.62.2Fixed in 0.62.3
  • 0.61.x and older0.59.0 – 0.61.5No fix, no longer updated

On 0.64.x, the newest line:

npm install react-native@0.64.1
1000.x

  1. Not affected

    1000.0.0

    1 release

0.x

  1. Not affected

    0.0.0 – 0.58.6

    169 releases

  2. Affected

    0.59.0 – 0.62.2

    27 releases

  3. Fixed

    0.62.3

    1 release

  4. Affected

    0.63.0 – 0.64.0

    7 releases

  5. Fixed

    0.64.1 – 0.88.0

    182 releases, latest

387 stable releases of react-native, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-native. It is read in your browser and sent nowhere.

What happens

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.