{"id":"CVE-2023-26115","aliases":["AZL-43867","AZL-44184","CLSA-2026-1782954036","EUVD-2023-1831","GHSA-j8xg-fqg3-53r7","ROOT-APP-NPM-CVE-2023-26115"],"status":"published","title":"word-wrap vulnerable to Regular Expression Denial of Service","description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01709,"percentile":0.77523,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2023-06-22T05:00:01Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"word-wrap","fixed_in":["1.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"word-wrap","fixed_in":["1.2.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/word-wrap","fixed_in":["1.2.3-root.io.1","1.2.3-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"word-wrap","fixed_in":["1.2.3-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"word-wrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"word-wrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-tuxcare.0"},{"fixed":"1.2.3-tuxcare.1"}]}],"versions":["1.2.3"]},{"source":"osv","ecosystem":"npm","package":"word-wrap","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/word-wrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-root.io.1"},{"fixed":"1.2.3-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"word-wrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-aikido.2"}]}]}],"products":[{"vendor":"word-wrap_project","product":"word-wrap"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39","tags":["x_transferred","Broken Link","web"]},{"url":"https://github.com/jonschlinkert/word-wrap/releases/tag/1.2.4","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26115","tags":["web","advisory"]},{"url":"https://github.com/jonschlinkert/word-wrap/blob/master/index.js#L39","tags":["web"]},{"url":"https://github.com/jonschlinkert/word-wrap/commit/420dce9a2412b21881202b73a3c34f0edc53cb2e","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j8xg-fqg3-53r7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26115.json","tags":["advisory"]},{"url":"https://github.com/jonschlinkert/word-wrap","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-26115","description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","status":"published","published":"2023-06-22T05:00:01.472Z","modified":"2025-02-13T16:44:48.145Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:35:15.066338Z"}],"euvd":[{"id":"EUVD-2023-1831","description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","status":"published","published":"2023-06-22T05:00:01Z","modified":"2025-02-13T16:44:48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium"}],"updated_at":"2026-11-03T00:03:50.947767Z"}],"ghsa":[{"id":"GHSA-j8xg-fqg3-53r7","title":"word-wrap vulnerable to Regular Expression Denial of Service","description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","status":"published","published":"2023-06-22T06:30:18Z","modified":"2025-02-13T19:00:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2023-26115","description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","status":"published","published":"2023-06-22T05:15:09.157Z","modified":"2026-06-17T05:42:42.64Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:08:12.414559Z"}],"osv":[{"id":"AZL-43867","title":"CVE-2023-26115 affecting package js-jquery 3.5.0-4","description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","status":"published","published":"2023-06-22T05:15:09Z","modified":"2026-04-21T04:31:11.226026Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44184","title":"CVE-2023-26115 affecting package js-jquery 3.5.0-4","description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","status":"published","published":"2023-06-22T05:15:09Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2023-26115","description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","status":"published","published":"2023-06-22T05:00:01.472Z","modified":"2026-10-28T02:30:52.132936638Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"GHSA-j8xg-fqg3-53r7","title":"word-wrap vulnerable to Regular Expression Denial of Service","description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","status":"published","published":"2023-06-22T06:30:18Z","modified":"2025-02-13T19:00:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"ROOT-APP-NPM-CVE-2023-26115","title":"CVE-2023-26115 in @rootio/word-wrap - Patched by Root","description":"Root has patched CVE-2023-26115 in the @rootio/word-wrap package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T21:04:47Z","modified":"2026-06-05T01:30:38.238718491Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"CLSA-2026-1782954036","title":"TuxCare security update for word-wrap (1 CVE)","description":"TuxCare rebuilt word-wrap to address 1 CVE. Fixed in 1.2.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:41Z","modified":"2026-10-15T09:47:51.705799194Z","updated_at":"2026-11-02T15:43:45.794021Z"}]}}