| Package | Affected versions | Patched versions |
|---|---|---|
| fast-xml-parser | = 4.2.4 | |
| fast-xml-parser | ≥ 4.3.5, < 4.4.1 | 4.4.1 |
A ReDOS that exists on currency.js was discovered by Gauss Security Labs R&D team.
https://github.com/NaturalIntelligence/fast-xml-parser/blob/v4.4.0/src/v5/valueParsers/currency.js#L10 contains a vulnerable regex
pass the following string '\t'.repeat(13337) + '.'
Denial of service during currency parsing in experimental version 5 of fast-xml-parser-library
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free