HighGHSA-7p7h-4mm5-852vCVE-2021-33623
Uncontrolled Resource Consumption in trim-newlines
Published 7 Jun 2021 · Updated 10 Sept 2026
Affected packages
- Affected
- <3.0.1
- Fixed in
- 3.0.1
Update to the fixed version for your release line, for example:
npm install trim-newlines@3.0.1- Affected
- >=4.0.0 <4.0.1
- Fixed in
- 4.0.1
Update to the fixed version for your release line, for example:
npm install trim-newlines@4.0.1Details
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Is GHSA-7p7h-4mm5-852v in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected trim-newlines, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2021-33623
- Linkgithub.com/sindresorhus/trim-newlines/commit/25246c6ce5eea1c82d448998733a6302a4350d91
- Linkgithub.com/sindresorhus/trim-newlines/commit/b10d5f4afef832b16bc56d49fc52c68cbd403869
- Packagegithub.com/sindresorhus/trim-newlines
- Linkgithub.com/sindresorhus/trim-newlines/releases/tag/v4.0.1
- Linklists.debian.org/debian-lts-announce/2022/12/msg00033.html
- Linksecurity.netapp.com/advisory/ntap-20210702-0007
- Linkwww.npmjs.com/package/trim-newlines
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.