Skip to content
OpenAdvisories

Package · npm

underscore.string

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium —
    GHSA-v2p6-4mp7-3r9v

    Regular Expression Denial of Service in underscore.string

    Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS). The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows …

    underscore.string npm