Regular Expression Denial of Service in riot-compiler

HOCH 7.5CVE-2016-10527 · GHSA-pp4v-55vr-9gxh · Published 31/05/2018 · updated 17/06/2026

Kurz gesagt

CVE-2016-10527 ist eine Schwachstelle (HOCH (CVSS 7.5)) in riot-compiler (riot.js), riot-compiler.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.6%, höher als bei 75.6% aller Schwachstellen.
Abhilfe: auf 2.3.22 oder neuer aktualisieren.

Package	Affected versions	Patched versions
riot-compiler riot.js	`= 2.3.21`	No fix yet
riot-compiler npm	`< 2.3.22`	`2.3.22`

Affected versions of riot-compiler are susceptible to a regular expression denial of service vulnerability.

Update to version 2.3.22 or later.

NVD description

The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.