{"id":"GHSA-qx4v-6gc5-f2vv","aliases":[],"status":"published","title":"Regular Expression Denial of Service","description":"A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2019-06-20T14:32:56Z","modified":"2023-01-09T05:01:40Z","fixes":[{"ecosystem":"npm","package":"esm","fixed_in":["3.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"esm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0"}]}]},{"source":"osv","ecosystem":"npm","package":"esm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.0"}]}]}],"references":[{"url":"https://github.com/standard-things/esm/issues/694","tags":["web"]},{"url":"https://github.com/standard-things/esm/commit/c41e001d81a5a52b0d2d1722b1c2af04d997c05b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qx4v-6gc5-f2vv"}],"sources":{"ghsa":[{"id":"GHSA-qx4v-6gc5-f2vv","title":"Regular Expression Denial of Service","description":"A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.","status":"published","published":"2019-06-20T14:32:56Z","modified":"2023-01-09T05:01:40Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-qx4v-6gc5-f2vv","title":"Regular Expression Denial of Service","description":"A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.","status":"published","published":"2019-06-20T14:32:56Z","modified":"2021-02-25T17:20:28Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}