| Package | Affected versions | Patched versions |
|---|---|---|
| org.webjars.npm:jquery | ≥ 3.0.0-rc1, < 3.0.0 | 3.0.0 |
| jQuery | ≥ 3.0.0-rc.1, < 3.0.0 | 3.0.0 |
| jquery-rails | ≥ 3.0.0-rc.1, < 3.0.0 | 3.0.0 |
| jquery | = 3.0.0 | |
| jquery | ≥ 3.0.0-rc.1, < 3.0.0 | 3.0.0 |
Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.
Update to version 3.0.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free