Log in Start free

Vulnerability · Published Feb 26, 2024 · Assigned by GitHub_M

CVE-2024-27088es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

None 0.0

In plain English

A uncontrolled resource consumption in es5-ext from medikoo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)0.0None
Exploit odds (30 days)0.5%top 54.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-es5-extno fix listedDEBIAN-CVE-2024-27088
Debian:13node-es5-ext0.10.64+dfsg1+~1.1.0-1DEBIAN-CVE-2024-27088
Debian:14node-es5-ext0.10.64+dfsg1+~1.1.0-1DEBIAN-CVE-2024-27088
Ubuntu:22.04:LTSnode-es5-extno fix listedUBUNTU-CVE-2024-27088
Ubuntu:24.04:LTSnode-es5-extno fix listedUBUNTU-CVE-2024-27088
Ubuntu:25.10node-es5-extno fix listedUBUNTU-CVE-2024-27088
Ubuntu:26.04:LTSnode-es5-extno fix listedUBUNTU-CVE-2024-27088
Ubuntu:26.10node-es5-extno fix listedUBUNTU-CVE-2024-27088
npmes5-ext0.10.63GHSA-4gmj-3p3h-gm8h

Affected products (as reported)

VendorProductVersions
medikoo es5-ext >= 0.10.0, < 0.10.63

Weakness: CWE-400, CWE-1333 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N

References