Regular expression denial of service in word-wrap
Priority HIGH 72CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 20 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01709 77th percentileScored 2026-11-07
Fix Partial word-wrap (npm): 1.2.4Red Hat: 7 advisoriesRed Hat: 8 fixed, 20 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | word-wrap | all versions | — | No fix listed | CNA |
| — | org.webjars.npm:word-wrap | all versions | — | No fix listed | CNA |
| — | word-wrap (npm) | before 1.2.4 | 1.2.4 | Patch available | GHSA-j8xg-fqg3-53r7 |
- word-wrap Vendor— Affected all versions Fixed in — No fix listed CNA
- org.webjars.npm:word-wrap Vendor— Affected all versions Fixed in — No fix listed CNA
- word-wrap (npm) Vendor— Affected before 1.2.4 Fixed in 1.2.4 Patch available GHSA-j8xg-fqg3-53r7
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:word-wrap_project:word-wrap:*:*:*:*:*:node.js:*:* | before 1.2.4 | Vulnerable | Word-wrap Project |
- cpe:2.3:a:word-wrap_project:word-wrap:*:*:*:*:*:node.js:*:* Versions before 1.2.4 Vulnerable ·Word-wrap Project
Remediation
- Fix · GHSA-j8xg-fqg3-53r7 word-wrap (npm) Fixed in 1.2.4 Advisory →
Red Hat 7 advisories
- RHSA-2024:8581 Released 2024-10-29 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.13.2 security update
- Red Hat OpenShift GitOps 1.13 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
- RHSA-2023:7681 Released 2023-12-12 · Red Hat rating ImportantOpenShift Container Platform 4.14.6 security and extras update
- Red Hat OpenShift Container Platform 4.14 openshift4/nmstate-console-plugin-rhel8, openshift4/ose-clusterresourceoverride-rhel8, openshift4/ose-clusterresourceoverride-rhel8-operator +1
- RHSA-2023:5006 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
Show 4 more Red Hat advisories
- RHSA-2023:5447 Released 2023-10-05 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.0 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-ui-rhel8
- RHSA-2023:5379 Released 2023-09-28 · Red Hat rating ImportantNetwork Observability 1.4.0 for OpenShift
- NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 +2
- RHSA-2023:5376 Released 2023-09-27 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.3 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/odf-console-rhel9
- RHSA-2023:3998 Released 2023-07-12 · Red Hat rating ModerateLogging Subsystem 5.7.3 - Red Hat OpenShift security update
- RHOL 5.7 for RHEL 8 openshift-logging/logging-view-plugin-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Discovery 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2023:5447 |
| NETOBSERV 1.4 for RHEL 9 | Fixed | RHSA-2023:5379 |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:5376 |
| RHOL 5.7 for RHEL 8 | Fixed | RHSA-2023:3998 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5006, RHSA-2023:7681 |
| Red Hat OpenShift GitOps 1.13 | Fixed | RHSA-2024:8581 |
| Red Hat OpenShift GitOps 1.14 | Fixed | — |
| Red Hat OpenShift GitOps 1.15 | Fixed | — |
Not affected: 21 products
- 8Base-RHMTC-1.8
- A-MQ Interconnect 1
- Cryostat 2
- Migration Toolkit for Runtimes
- RHODF 4.13 for RHEL 9
- RHOL 5.7 for RHEL 8
- Red Hat A-MQ Online
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift GitOps
- Red Hat OpenShift GitOps 1.13
- Red Hat OpenShift GitOps 1.14
- Red Hat OpenShift GitOps 1.15
- Red Hat Openshift Data Foundation 4
- Red Hat Single Sign-On 7
- Red Hat build of Apicurio Registry 2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26115
- 2026-10-03 Alias added: GHSA-j8xg-fqg3-53r7
References
Advisory 2
Other 6
- https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://github.com/jonschlinkert/word-wrap/commit/420dce9a2412b21881202b73a3c34f0edc53cb2e
- https://github.com/jonschlinkert/word-wrap
- https://github.com/jonschlinkert/word-wrap/blob/master/index.js#L39
- https://security.netapp.com/advisory/ntap-20240621-0006
Sources
- CVE-2023-26115 · CVE Program
- CVE-2023-26115 · NVD
- FIRST EPSS
- GHSA-j8xg-fqg3-53r7 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-26115 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences