CVE-2021-23353
CVE-2021-23353 · Regular Expression Denial of Service (ReDoS)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.
CVSS 5.9 · Medium · EPSS 2.6% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://snyk.io/vuln/SNYK-JS-JSPDF-1073626
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1083286
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1083287
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-1083288
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1083289
- https://github.com/MrRio/jsPDF/commit/d8bb3b39efcd129994f7a3b01b632164144ec43e
- https://github.com/MrRio/jsPDF/pull/3091
- https://nvd.nist.gov/vuln/detail/CVE-2021-23353