kangax html-minifier REDoS vulnerability · CVE-2022-37620 · GitHub Advisory Database · GitHub

kangax html-minifier REDoS vulnerability

High severity GitHub Reviewed Published Oct 31, 2022 to the GitHub Advisory Database • Updated Apr 22, 2024

Package

html-minifier (npm)

Affected versions

<= 4.0.0

Patched versions

None

Description

A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 via the candidate variable in htmlminifier.js.

References

Published by the National Vulnerability Database

Oct 31, 2022

Published to the GitHub Advisory Database Oct 31, 2022

Reviewed Apr 22, 2024

Last updated Apr 22, 2024

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H