CVE-2023-50249: Inefficient Regular Expression Complexity

December 20, 2023 (updated December 28, 2023)

Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry’s Astro SDK 7.78.0-7.86.0. Under certain conditions, this vulnerability allows an attacker to cause excessive computation times on the server, leading to denial of service (DoS). This vulnerability has been patched in sentry/astro version 7.87.0.

References

github.com/getsentry/sentry-javascript/commit/fe24eb5eefa9d27b14b2b6f9ebd1debca1c208fb
github.com/getsentry/sentry-javascript/pull/9815
github.com/getsentry/sentry-javascript/security/advisories/GHSA-x3v3-8xg8-8v72
nvd.nist.gov/vuln/detail/CVE-2023-50249

Code Behaviors & Features

Detect and mitigate CVE-2023-50249 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →