The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
References
| Link | Resource |
|---|---|
| https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1 | Release Notes Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20210706-0001/ | Third Party Advisory |
| https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1 | Release Notes Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20210706-0001/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1 - Release Notes, Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20210706-0001/ - Third Party Advisory |
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1333 |
26 Oct 2021, 19:56
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:normalize-url_project:normalize-url:6.0.0:*:*:*:*:node.js:*:* | |
| References |
|
28 May 2021, 14:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1 - Release Notes, Third Party Advisory | |
| CPE | cpe:2.3:a:normalize-url_project:normalize-url:*:*:*:*:*:node.js:*:* | |
| CWE | NVD-CWE-Other | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
24 May 2021, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-05-24 16:15
Updated : 2024-11-21 06:08
NVD link : CVE-2021-33502
Mitre link : CVE-2021-33502
CVE.ORG link : CVE-2021-33502
JSON object : View
Products Affected
normalize-url_project
- normalize-url
CWE
CWE-1333
Inefficient Regular Expression Complexity