GHSA-fvwr-h9xh-m6wc
Denial of Service in @commercial/subtext
GHSA-fvwr-h9xh-m6wc is a vulnerability with no CVSS score yet in @commercial/subtext, published September 3, 2020. No source lists public exploit code. Fixed in @commercial/subtext 5.1.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.1.1@commercial/subtext
Description
Versions of @commercial/subtext prior to 5.1.1 are vulnerable to Denial of Service (DoS). The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.
Recommendation
Upgrade to version 5.1.1 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@commercial/subtextnpm | before 5.1.1 | 5.1.1 |
What each source reports
GitHub AdvisoriesNo score
Denial of Service in @commercial/subtext
Versions of @commercial/subtext prior to 5.1.1 are vulnerable to Denial of Service (DoS). The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.
Recommendation
Upgrade to version 5.1.1 or later.
- Record
GHSA-fvwr-h9xh-m6wc- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVNo score
Denial of Service in @commercial/subtext
Versions of @commercial/subtext prior to 5.1.1 are vulnerable to Denial of Service (DoS). The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.
Recommendation
Upgrade to version 5.1.1 or later.
- Record
GHSA-fvwr-h9xh-m6wc- Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.