p PatchFirst

PatchFirst · Latest vulnerabilities

diff vulnerabilities

Vulnerabilities published for diff in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-24001

    Low · CVSS 2.7EPSS 0.62%Fix available

    jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

    jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\r`, `\u2028`, or `\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore

    diff diff diff diffNode.js
    • Update to 3.5.1
    • Update to 4.0.4
    • Update to 5.2.2
    • Update to 8.0.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →