CVE-2022-25887

Sanitize-html Vulnerable To REDoS Attacks

Description

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

Patch Available

Fix available through Seal Security.  
No upgrade required, protect your application instantly.

Fix without upgrading

Score

Severity

Ecosystem

JavaScript

Publish Date

August 30, 2022

Modified Date

April 22, 2024

Score Vector

Affected Versions