Vulnerability · Published Jun 4, 2020 · Assigned by snyk

CVE-2020-7661

High 7.5

In plain English

A high-severity security flaw in url-regex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.7%top 14.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	url-regex	no fix listed	GHSA-v4rh-8p82-6h5w

Affected products (as reported)

Vendor	Product	Versions
n/a	url-regex	all versions

References

https://github.com/kevva/url-regex/issues/70 x_refsource_MISC
https://snyk.io/vuln/SNYK-JS-URLREGEX-569472 x_refsource_MISC