Description

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.

Remediation

References

https://github.com/JefferyHus/es6-crawler-detect/pull/27

https://snyk.io/vuln/SNYK-JS-ES6CRAWLERDETECT-1051529

Related Vulnerabilities

CVE-2021-31404 Vulnerability in maven package com.vaadin:flow-server

CVE-2022-31160 Vulnerability in maven package org.webjars.npm:jquery-ui

CVE-2021-37578 Vulnerability in maven package org.apache.juddi:juddi-core

CVE-2021-29620 Vulnerability in maven package com.epam.reportportal:service-api

CVE-2022-37262 Vulnerability in npm package steal

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Patch Third Party Advisory Exploit NVD-CWE-Other