Description
charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | charset node module | <1.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | charset | < 1.0.1 | 1.0.1 | GHSA-9cp3-fh5x-xfcj |