Regular Expression Denial of Service (ReDoS) Affecting bleach package, versions *
Snyk CVSS
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:bleach:20151024
- published 6 Nov 2015
- disclosed 24 Oct 2015
- credit Adam Baldwin
Introduced: 24 Oct 2015
CVE-2014-8881 Open this link in a new tabOverview
bleach 3.0 and earlier is vulnerable to Regular expression Denial of Service (ReDoS) when certain types of input are passed into the sanitize function.
bleach performs html sanitization, which has definite value from a security perspective. However, it does not control the length of the html it processes, and uses regular expressions to parse it. As a result, it is susceptible to a Regular expression Denial of Service (ReDoS) vulnerabilities, rendering an application unavailable if a long or complex input is passed in.