Vulnerability · Published Sep 8, 2025 · Assigned by GitHub_M
CVE-2025-58451Cattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource Consumption
High 8.7
In plain English
A high-severity regular-expression denial of service in Cattown from IEatUranium238. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cattown is a JavaScript markdown parser. Versions prior to 1.0.2 used regular expressions with inefficient, potentially exponential worst-case complexity. This could cause excessive CPU usage due to excessive backtracking on crafted inputs. In turn, the excessive CPU usage could lead to resource exhaustion, where processing malicious inputs could cause high CPU or memory usage, potentially leading to denial of service. Version 1.0.2 contains a patch. Additionally, users should review and restrict input sources if untrusted inputs are processed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | cattown | 1.0.2 | GHSA-455v-w7r9-3vv9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IEatUranium238 | Cattown | < 1.0.2 |
Weakness: CWE-1333, CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N