| Package | Affected versions | Patched versions |
|---|---|---|
| is-svg | ≥ 2.1.0, ≤ 4.2.1 | |
| is-svg | ≥ 2.1.0, < 4.2.2 | 4.2.2 |
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free