Description
The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | printf | unspecified – < 0.6.1 | 0.6.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | printf | < 0.6.1 | 0.6.1 | GHSA-xfhp-gmh8-r8v2 |