Home > Vulnerability Database > CVE-2024-27088

Mend.io Vulnerability Database

CVE-2024-27088

Good to know:

Date: February 26, 2024

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.

Language: JS

Severity Score

0.0

Related Resources (7)

Url: https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2

Url: https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-27088

Url: https://github.com/medikoo/es5-ext/security/advisories/GHSA-4gmj-3p3h-gm8h

Url: https://security-tracker.debian.org/tracker/CVE-2024-27088

Url: https://github.com/medikoo/es5-ext/issues/201

Url: https://www.mend.io/vulnerability-database/CVE-2024-27088

Weakness Type (CWE)

Uncontrolled Resource Consumption ('Resource Exhaustion')

CWE-400

Inefficient Regular Expression Complexity

CWE-1333

Top Fix

Upgrade Version

Upgrade to version es5-ext - 0.10.63

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	HIGH
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE