Read the docs
TI-2021-06057 Aliases CVE-2021-23362GHSA-43f8-2h32-f4cj

Regular expression denial of service (ReDoS) in hosted-git-info

Priority LOW 30CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 7 fixed, 11 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Why it matters now

EPSS 0.03612 89th percentileScored 2026-11-07
Fix Partial hosted-git-info: 3.0.8hosted-git-info (npm): 2.8.9, 3.0.8Red Hat: 7 advisoriesRed Hat: 7 fixed, 11 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—hosted-git-infobefore 3.0.83.0.8Patch availableCNA
—hosted-git-info (npm)before 2.8.92.8.9Patch availableGHSA-43f8-2h32-f4cj
—hosted-git-info (npm)3.0.0 to before 3.0.83.0.8Patch availableGHSA-43f8-2h32-f4cj
  • hosted-git-info Vendor— Affected before 3.0.8 Fixed in 3.0.8 Patch available CNA
  • hosted-git-info (npm) Vendor— Affected before 2.8.9 Fixed in 2.8.9 Patch available GHSA-43f8-2h32-f4cj
  • hosted-git-info (npm) Vendor— Affected 3.0.0 to before 3.0.8 Fixed in 3.0.8 Patch available GHSA-43f8-2h32-f4cj

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:npmjs:hosted-git-info:*:*:*:*:*:*:*:*2.0.0 to before 2.8.9; 3.0.0 to before 3.0.8VulnerableNpmjs
cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*before 1.0.1.1VulnerableSiemens
  • cpe:2.3:a:npmjs:hosted-git-info:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.8.9; 3.0.0 to before 3.0.8 Vulnerable ·Npmjs
  • cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* Versions before 1.0.1.1 Vulnerable ·Siemens

Remediation

  • Fix · CNA hosted-git-info Fixed in 3.0.8
  • Fix · GHSA-43f8-2h32-f4cj hosted-git-info (npm) Fixed in 2.8.9 Advisory →
  • Fix · GHSA-43f8-2h32-f4cj hosted-git-info (npm) Fixed in 3.0.8 Advisory →

Red Hat 7 advisories

  • RHSA-2021:3638 Released 2021-09-22 · Red Hat rating Important
    nodejs:12 security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.s390x::nodejs:12 +19
  • RHSA-2021:3639 Released 2021-09-22 · Red Hat rating Important
    nodejs:12 security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.s390x::nodejs:12 +19
  • RHSA-2021:3074 Released 2021-08-10 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.17.3-2.module+el8.4.0+11738+3bd42762.aarch64::nodejs:14, nodejs-1:14.17.3-2.module+el8.4.0+11738+3bd42762.ppc64le::nodejs:14, nodejs-1:14.17.3-2.module+el8.4.0+11738+3bd42762.s390x::nodejs:14 +19
Show 4 more Red Hat advisories
  • RHSA-2021:3073 Released 2021-08-10 · Red Hat rating Moderate
    nodejs:12 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.22.3-2.module+el8.4.0+11732+c668cc9f.aarch64::nodejs:12, nodejs-1:12.22.3-2.module+el8.4.0+11732+c668cc9f.ppc64le::nodejs:12, nodejs-1:12.22.3-2.module+el8.4.0+11732+c668cc9f.s390x::nodejs:12 +19
  • RHSA-2021:2932 Released 2021-07-28 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-14.17.2-1.el7, rh-nodejs14-nodejs-devel-14.17.2-1.el7, rh-nodejs14-nodejs-docs-14.17.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-14.17.2-1.el7, rh-nodejs14-nodejs-devel-14.17.2-1.el7, rh-nodejs14-nodejs-docs-14.17.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-14.17.2-1.el7, rh-nodejs14-nodejs-devel-14.17.2-1.el7, rh-nodejs14-nodejs-docs-14.17.2-1.el7 +2
  • RHSA-2021:2931 Released 2021-07-28 · Red Hat rating Moderate
    rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.22.2-1.el7, rh-nodejs12-nodejs-devel-12.22.2-1.el7, rh-nodejs12-nodejs-docs-12.22.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.22.2-1.el7, rh-nodejs12-nodejs-devel-12.22.2-1.el7, rh-nodejs12-nodejs-docs-12.22.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.22.2-1.el7, rh-nodejs12-nodejs-devel-12.22.2-1.el7, rh-nodejs12-nodejs-docs-12.22.2-1.el7 +2
  • RHSA-2021:2438 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Quay 3AffectedNo fix yet: Fix deferred
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:3073, RHSA-2021:3074
Red Hat Enterprise Linux AppStream EUS (v. 8.1)Fixed RHSA-2021:3639
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2021:3638
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2438
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:2931, RHSA-2021:2932
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:2931, RHSA-2021:2932
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:2931, RHSA-2021:2932
Not affected: 4 products
  • Distributed Tracing Jaeger 1
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ceph Storage 4
  • Red Hat OpenShift Container Platform 4.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23362
  2. 2026-10-03 Alias added: GHSA-43f8-2h32-f4cj

References

Patch 5

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences