| Package | Affected versions | Patched versions |
|---|---|---|
| hosted-git-info | ≥ 2.0.0, < 2.8.9≥ 3.0.0, < 3.0.8 | 2.8.93.0.8 |
| sinec infrastructure network services | < 1.0.1.1 | 1.0.1.1 |
| hosted-git-info | ≥ 3.0.0, < 3.0.8< 2.8.9 | 3.0.82.8.9 |
The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free