-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from regex patterns with nested quantifiers ([a-z]+\s*)+ and ([A-Z]+\s*)+ that exhibit exponential time complexity when matching crafted inputs. The commit diff shows these regex-based implementations were replaced with direct string comparison checks in the patch, confirming they were the vulnerable components. The payload example demonstrates how small inputs could trigger excessive backtracking, matching the ReDoS pattern described in CWE-1333.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| v8n | npm | < 1.5.1 | 1.5.1 |
Ongoing coverage of React2Shell