Packages / fresh / Security

HighVulnerabilityGHSA-9qj9-36jm-prpvCVE-2017-16119Published 24 Jul 2018

Regular Expression Denial of Service in fresh

Your version

Affected releases · fresh

  • 0.5.x0.5.0 – 0.5.1Fixed in 0.5.2
  • 0.4.x and older0.0.1 – 0.4.0No fix, no longer updated

On 0.5.x, the newest line:

npm install fresh@0.5.2
Every release on a timeline
2.x

  1. Not affected

    2.0.0

    1 release

0.x

  1. Affected

    0.0.1 – 0.5.1

    11 releases

  2. Fixed

    0.5.2

    1 release, latest

14 stable releases of fresh, oldest to newest, one row per major.

What happens

Affected versions of fresh are vulnerable to regular expression denial of service when parsing specially crafted user input.

Recommendation

Update to version 0.5.2 or later.