N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58451

CVE-2025-58451: Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity

Overview

A security review of the Cattown identified multiple weaknesses that could potentially impact its stability and security.

Affected Versions

All versions below 1.0.2

Description of Vulnerabilities

CWE-1333: Inefficient Regular Expression Complexity The package used regular expressions with inefficient, potentially exponential worst-case complexity. This can cause excessive CPU usage due to excessive backtracking on crafted inputs, potentially leading to denial of service.
CWE-400: Uncontrolled Resource Consumption (Resource Exhaustion) The package was vulnerable to resource exhaustion, where processing malicious inputs could cause high CPU or memory usage, potentially leading to denial of service.

Impact

Trigger excessive CPU consumption leading to denial of service
Cause resource exhaustion affecting service availability
Bypass protection mechanisms causing unexpected or insecure behavior

Resolution

These vulnerabilities have been fixed in version 1.0.2 of the Cattown. Users are strongly encouraged to upgrade to this version to mitigate the risks.

Recommendations

Upgrade to Cattown version 1.0.2 or later as soon as possible.
Review and restrict input sources if untrusted inputs are processed.

Acknowledgments

The issues were proactively identified through CodeQL static analysis.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-58451

CVE-2025-58451:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cattown	npm	< 1.0.2	1.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security advisory points to a regular expression denial of service (ReDoS) vulnerability in the Cattown package, fixed in version 1.0.2. The provided commit 70c2a28fb7dc520cfb7e401e0e141bff3dd26ead confirms the version bump and contains the security patch.

The analysis of the commit shows changes in src/tokenizer.js within the tokenizeUserInput function. This function contains a nested function, tokenizeInline, where the vulnerable regular expressions are defined and used. The patch modifies these regular expressions to be more specific and less prone to backtracking, for example, by changing [^)]+ to [^()\s]+. Additionally, a length limit is imposed on the input to further mitigate the risk.

Since tokenizeInline is an inner function, the entry point for any malicious input and the function that would appear in a profiler's stack trace during exploitation is tokenizeUserInput. Therefore, tokenizeUserInput is identified as the vulnerable function. The vulnerability is directly tied to the inefficient regex patterns it used for parsing, which could be exploited to cause a denial of service.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-58451: Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity

Overview

Affected Versions

Description of Vulnerabilities

Impact

Resolution

Recommendations

Acknowledgments

CVE-2025-58451:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-58451: Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity

Overview

Affected Versions

Description of Vulnerabilities

Impact

Resolution

Recommendations

Acknowledgments

Technical Details

N/A

N/A

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI