Cattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource Consumption
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.
Summary
Cattown is a JavaScript markdown parser. Versions prior to 1.0.2 used regular expressions with inefficient, potentially exponential worst-case complexity. This could cause excessive CPU usage due to excessive backtracking on crafted inputs. In turn, the excessive CPU usage could lead to resource exhaustion, where processing malicious inputs could cause high CPU or memory usage, potentially leading to denial of service. Version 1.0.2 contains a patch. Additionally, users should review and restrict input sources if untrusted inputs are processed.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IEatUranium238 | Cattown | before 1.0.2 | 1.0.2 | Patch available | CNA |
| — | cattown (npm) | before 1.0.2 | 1.0.2 | Patch available | GHSA-455v-w7r9-3vv9 |
- Cattown VendorIEatUranium238 Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA
- cattown (npm) Vendor— Affected before 1.0.2 Fixed in 1.0.2 Patch available GHSA-455v-w7r9-3vv9
Remediation
- Fix · CNA Cattown (IEatUranium238) Fixed in 1.0.2
- Fix · GHSA-455v-w7r9-3vv9 cattown (npm) Fixed in 1.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58451
- 2026-10-03 Alias added: GHSA-455v-w7r9-3vv9
References
Other 5
- https://github.com/IEatUranium238/Cattown/security/advisories/GHSA-455v-w7r9-3vv9
- https://github.com/IEatUranium238/Cattown/commit/70c2a28fb7dc520cfb7e401e0e141bff3dd26ead
- https://github.com/IEatUranium238/Cattown
- https://github.com/IEatUranium238/Cattown/releases/tag/security
- https://www.npmjs.com/package/cattown
Sources
- CVE-2025-58451 · CVE Program
- CVE-2025-58451 · NVD
- FIRST EPSS
- GHSA-455v-w7r9-3vv9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences