CVE-2022-25881

http-cache-semantics vulnerable to Regular Expression Denial of Service in npm/http-cache-semantics

Identifiers

CVE-2022-25881, GHSA-rc47-6667-2j5j

Package Slug

npm/http-cache-semantics

Vulnerability

http-cache-semantics vulnerable to Regular Expression Denial of Service

Description

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Affected Versions

All versions before 4.1.1

Solution

Upgrade to version 4.1.1 or above.

Last Modified

2023-02-02

source