CVE-2024-25355: s3-url-parser vulnerable to Denial of Service via regexes component

May 1, 2024 (updated May 3, 2024)

s3-url-parser 1.0.3 is vulnerable to denial of service via the regexes component.

References

gist.github.com/6en6ar/a4977866c59cbcfc716f0f2717b812bf
github.com/AntonioRecaldeRusso/s3-url-parser
github.com/AntonioRecaldeRusso/s3-url-parser/blob/master/index.js
github.com/advisories/GHSA-r4q9-xx5g-j24p
nvd.nist.gov/vuln/detail/CVE-2024-25355

Code Behaviors & Features

Detect and mitigate CVE-2024-25355 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →