ReDoS in uri-template-lite URI.expand function
Priority LOW 35CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-1333.
Summary
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method
Why it matters now
EPSS 0.00993 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed uri-template-lite (uri-template-lite): 22.9.0uri-template-lite (npm): 22.9.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| uri-template-lite | uri-template-lite | before 22.9.0 | 22.9.0 | Patch available | CNA |
| — | uri-template-lite (npm) | before 22.9.0 | 22.9.0 | Patch available | GHSA-chw2-6c7r-37p7 |
- uri-template-lite Vendoruri-template-lite Affected before 22.9.0 Fixed in 22.9.0 Patch available CNA
- uri-template-lite (npm) Vendor— Affected before 22.9.0 Fixed in 22.9.0 Patch available GHSA-chw2-6c7r-37p7
Remediation
- Fix · CNA uri-template-lite (uri-template-lite) Fixed in 22.9.0
- Fix · GHSA-chw2-6c7r-37p7 uri-template-lite (npm) Fixed in 22.9.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43309
- 2026-10-03 Alias added: GHSA-chw2-6c7r-37p7
References
Other 5
- https://github.com/litejs/uri-template-lite/compare/v22.1.0...v22.9.0
- https://github.com/litejs/uri-template-lite/commit/cbeec2b2a275d819fb534137a155df14729706f8
- https://github.com/litejs/uri-template-lite
- https://github.com/litejs/uri-template-lite/commits/v22.9.0
- https://research.jfrog.com/vulnerabilities/uri-template-lite-redos-xray-211351
Sources
- CVE-2021-43309 · CVE Program
- CVE-2021-43309 · NVD
- FIRST EPSS
- GHSA-chw2-6c7r-37p7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences