Regular Expression Denial of Service in ssri

中危 5.9CVE-2018-7651 · GHSA-325j-24f4-qv5x · Published 04/03/2018 · updated 17/06/2026

要点

CVE-2018-7651 是影响 ssri (ssri project), ssri 的中危 (CVSS 5.9)漏洞。
未来 30 天内被利用的概率（EPSS）：1.7%，高于 77.4% 的漏洞。
修复：升级到 5.2.2 或更高版本。

Package	Affected versions	Patched versions
ssri ssri_project	`< 5.2.2`	`5.2.2`
ssri npm	`< 5.2.2`	`5.2.2`

Description

Version of ssri prior to 5.2.2 are vulnerable to regular expression denial of service (ReDoS) when using strict mode.

Recommendation

Update to version 5.2.2 or later.

NVD description

index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long base64 hash string.

References

nvd.nist.gov/vuln/detail/CVE-2018-7651 · ADVISORY
zkat/ssri · WEB
zkat/ssri commit d0ebcdc · WEB
GitHub Advisory GHSA-325j-24f4-qv5x · ADVISORY
zkat/ssri · PACKAGE
npmjs.com/advisories/565 · WEB
nodesecurity.io/advisories/565 · Third Party Advisory

ssri 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free