CVE-2022-22138: Uncontrolled Resource Consumption in fast-string-search

June 17, 2022 (updated June 28, 2022)

All versions of package fast-string-search is vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. One can cause the V8 to attempt reading from non-permitted locations and cause a segmentation fault due to the violation.

References

github.com/advisories/GHSA-4263-q746-94mw
nvd.nist.gov/vuln/detail/CVE-2022-22138
snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392367

Code Behaviors & Features

Detect and mitigate CVE-2022-22138 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →