Skip to content
Sign in
5.3 Medium

CVE-2022-25887 The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure…

Description

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

Affected products and versions

Product Affected versions Fixed in
sanitize-html 2.7 earliest → < 2.7.1 2.7.1

Other CVEs of sanitize-html

The 2 CVEs of sanitize-html →
CVE-2024-21501 Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend… 5.3 Medium
Track this CVE