Vulnerability Details : CVE-2021-3803
nth-check is vulnerable to Inefficient Regular Expression Complexity
Products affected by CVE-2021-3803
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:nth-check_project:nth-check:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-3803
0.38%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-3803
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
huntr.dev | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2021-3803
-
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.Assigned by:
- nvd@nist.gov (Primary)
- security@huntr.dev (Secondary)
References for CVE-2021-3803
-
https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726
fix(parse): Replace regex with hand-rolled parser (#9) · fb55/nth-check@9894c1d · GitHubPatch;Third Party Advisory
-
https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0
huntr: Inefficient Regular Expression Complexity TypeScript Vulnerability in nth-checkExploit;Issue Tracking;Patch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2023/05/msg00023.html
[SECURITY] [DLA 3428-1] node-nth-check security updateMailing List;Third Party Advisory
Jump to