CVE-2023-26115
word-wrap vulnerable to Regular Expression Denial of Service
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
- Record
CVE-2023-26115- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2023-1831
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
- Record
EUVD-2023-1831- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j8xg-fqg3-53r7
word-wrap vulnerable to Regular Expression Denial of Service
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
- Record
GHSA-j8xg-fqg3-53r7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
- Record
CVE-2023-26115- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVAZL-43867
CVE-2023-26115 affecting package js-jquery 3.5.0-4
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
- Record
AZL-43867- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-44184
CVE-2023-26115 affecting package js-jquery 3.5.0-4
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
- Record
AZL-44184- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
Show 4 moreShow less
OSV
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
- Record
CVE-2023-26115- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVGHSA-j8xg-fqg3-53r7
word-wrap vulnerable to Regular Expression Denial of Service
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
- Record
GHSA-j8xg-fqg3-53r7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2023-26115
CVE-2023-26115 in @rootio/word-wrap - Patched by Root
Root has patched CVE-2023-26115 in the @rootio/word-wrap package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2023-26115- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1782954036 No score
TuxCare security update for word-wrap (1 CVE)
TuxCare rebuilt word-wrap to address 1 CVE. Fixed in 1.2.3-tuxcare.1.
- Record
CLSA-2026-1782954036- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
word-wrapnpm |
before 1.2.4 | 1.2.4 |
js-jqueryAzure Linux:2 |
through 3.5.0-4 | None known |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
word-wrapTuxCare:npm |
1.2.3-tuxcare.0 up to 1.2.3-tuxcare.1, plus listed versions 1.2.3 |
1.2.3-tuxcare.1 |
@rootio/word-wrapRoot:npm |
before 1.2.3-root.io.1 | 1.2.3-root.io.11.2.3-root.io.2 |
word-wrapRoot:npm |
before 1.2.3-aikido.2 | 1.2.3-aikido.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-26115 is a medium vulnerability (CVSS 5.3) in Word-wrap Project Word-wrap, published June 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. Fixed in word-wrap 1.2.4.
References
security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973
github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39
security.netapp.com/advisory/ntap-20240621-0006
nvd.nist.gov/vuln/detail/CVE-2023-26115