CVE-2024-25354: domain-suffix RegEx Denial of Service

March 28, 2024 (updated September 3, 2025)

RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function.

References

gist.github.com/6en6ar/c3b11b4058b8e2bc54717408d451fb79
github.com/advisories/GHSA-cqfh-c4c5-c2hg
github.com/ikrong/domain-suffix
github.com/ikrong/domain-suffix/blob/master/src/domainSuffix.ts
nvd.nist.gov/vuln/detail/CVE-2024-25354

Code Behaviors & Features

Detect and mitigate CVE-2024-25354 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →