Regular Expression Denial of Service in is-svg Package for Node.js

CVE-2021-28092

What is CVE-2021-28092?

The is-svg package versions 2.1.0 through 4.2.1 for Node.js is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability. This flaw arises from the use of an inefficient regular expression that can lead an application to process certain malicious input excessively, potentially causing prolonged performance degradation or unresponsiveness. Attackers can exploit this by providing carefully crafted strings, effectively rendering the is-svg package unable to process other requests in a timely manner.

References