Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. uri-js
  4. ›
  5. GMS-2016-14

GMS-2016-14: Regular Expression Denial Of Service

March 15, 2016

uri-js is a module that tries to fully implement RFC One of these features is validating whether a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at % usage while uri-js is trying to validate if the supplied URL is valid or not.

References

  • github.com/garycourt/uri-js/issues/12
  • www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS

Code Behaviors & Features

Detect and mitigate GMS-2016-14 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions up to 2.1.1

Fixed versions

  • 3.0.0

Solution

Upgrade to v3.0.0

Source file

npm/uri-js/GMS-2016-14.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:16 +0000.