-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the 'expandRe' regular expression used in URI.expand, as shown in the commit diff. The patch modifies this regex to add a positive lookahead '(?=})' and remove redundant quantifiers, addressing catastrophic backtracking. The added test case demonstrates exploitation via a long '{0000...' pattern. Since URI.expand is explicitly mentioned in all vulnerability reports and the fix directly modifies its regex dependency, this is the clear entry point for the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| uri-template-lite | npm | < 22.9.0 | 22.9.0 |
JavaScriptJavaScriptOngoing coverage of React2Shell