{"id":"GHSA-86p3-4gfq-38f2","aliases":[],"status":"published","title":"Denial of Service in url-relative","description":"All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2019-06-05T14:10:34Z","modified":"2023-01-09T05:01:41Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"url-relative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"url-relative","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.0.0"}]}]}],"references":[{"url":"https://github.com/junosuarez/url-relative/issues/3","tags":["web"]},{"url":"https://www.npmjs.com/advisories/783","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-URLRELATIVE-173691","tags":["web"]},{"url":"https://github.com/advisories/GHSA-86p3-4gfq-38f2"}],"sources":{"ghsa":[{"id":"GHSA-86p3-4gfq-38f2","title":"Denial of Service in url-relative","description":"All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.","status":"published","published":"2019-06-05T14:10:34Z","modified":"2023-01-09T05:01:41Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-86p3-4gfq-38f2","title":"Denial of Service in url-relative","description":"All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.","status":"published","published":"2019-06-05T14:10:34Z","modified":"2021-08-04T21:31:03Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:42.077781Z"}]}}