Description
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | is-svg | >= 2.1.0, < 4.2.2 | 4.2.2 | GHSA-7r28-3m3f-r2pr |
Advisories 2
- WID-SEC-2022-1354 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 3, 2026
- WID-SEC-2023-2101 genua genucenter: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 20, 2023