Read the docs
TI-2020-19406 Aliases GHSA-6chw-6frg-f759

Regular Expression Denial of Service in Acorn

Priority LOW 38CWE-400Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-400.

Summary

Affected versions of acorn are vulnerable to Regular Expression Denial of Service. A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser. If an application processes untrusted input and passes it directly to acorn, attackers may leverage the vulnerability leading to Denial of Service.

Why it matters now

Fix Fixed acorn (npm): 5.7.4, 6.4.1, 7.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—acorn (npm)5.5.0 to before 5.7.45.7.4Patch availableGHSA-6chw-6frg-f759
—acorn (npm)6.0.0 to before 6.4.16.4.1Patch availableGHSA-6chw-6frg-f759
—acorn (npm)7.0.0 to before 7.1.17.1.1Patch availableGHSA-6chw-6frg-f759
  • acorn (npm) Vendor— Affected 5.5.0 to before 5.7.4 Fixed in 5.7.4 Patch available GHSA-6chw-6frg-f759
  • acorn (npm) Vendor— Affected 6.0.0 to before 6.4.1 Fixed in 6.4.1 Patch available GHSA-6chw-6frg-f759
  • acorn (npm) Vendor— Affected 7.0.0 to before 7.1.1 Fixed in 7.1.1 Patch available GHSA-6chw-6frg-f759

Remediation

  • Fix · GHSA-6chw-6frg-f759 acorn (npm) Fixed in 5.7.4 Advisory →
  • Fix · GHSA-6chw-6frg-f759 acorn (npm) Fixed in 6.4.1 Advisory →
  • Fix · GHSA-6chw-6frg-f759 acorn (npm) Fixed in 7.1.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-6chw-6frg-f759

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences