es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

MEDIUM 5.5CVE-2024-27088 · GHSA-4gmj-3p3h-gm8h · Published 26/02/2024 · updated 17/06/2026

In short

CVE-2024-27088 is a MEDIUM (CVSS 5.5) vulnerability affecting es5-ext (medikoo), es5-ext.
Chance of exploitation in the next 30 days (EPSS): 0.54%, higher than 45.6% of all vulnerabilities.
Fix: update to 0.10.63 or later.

Package	Affected versions	Patched versions
es5-ext medikoo	`≥ 0.10.0, < 0.10.63`	`0.10.63`
es5-ext npm	`≥ 0.10.0, < 0.10.63`	`0.10.63`

Description

Impact

Passing functions with very long names or complex default argument names into function#copy orfunction#toStringTokens may put script to stall

Patches

Fixed with https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2 and https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602 Published with v0.10.63

Workarounds

No real workaround aside of refraining from using above utilities.

References

https://github.com/medikoo/es5-ext/issues/201

NVD description

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.

References

medikoo/es5-ext security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-27088 · ADVISORY
medikoo/es5-ext · WEB
medikoo/es5-ext commit 3551cdd · WEB
medikoo/es5-ext commit a52e957 · WEB
medikoo/es5-ext · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

es5-ext

medikoo

≥ 0.10.0, < 0.10.63

0.10.63

es5-ext

npm

≥ 0.10.0, < 0.10.63

0.10.63

Description

NVD description