MediumGHSA-j8xg-fqg3-53r7CVE-2023-26115
word-wrap vulnerable to Regular Expression Denial of Service
Published 22 Jun 2023 · Updated 13 Feb 2025
Affected package
word-wrapnpm
- Affected
- <1.2.4
- Fixed in
- 1.2.4
Update to the fixed version for your release line, for example:
npm install word-wrap@1.2.4Details
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
Is GHSA-j8xg-fqg3-53r7 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected word-wrap, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-26115
- Linkgithub.com/jonschlinkert/word-wrap/commit/420dce9a2412b21881202b73a3c34f0edc53cb2e
- Packagegithub.com/jonschlinkert/word-wrap
- Linkgithub.com/jonschlinkert/word-wrap/blob/master/index.js#L39
- Linkgithub.com/jonschlinkert/word-wrap/blob/master/index.js%23L39
- Linkgithub.com/jonschlinkert/word-wrap/releases/tag/1.2.4
- Linksecurity.netapp.com/advisory/ntap-20240621-0006
- Linksecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657
- Linksecurity.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.