Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

tf2-item-format

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmAmendedPublished

    (ReDoS) Regular Expression Denial of Service in tf2-item-format

    CVE-2024-41655 · GHSA-8h55-q5qq-p685

    Affected
    • npm tf2-item-format >= 4.2.6, <= 5.9.13
    Fixed in
    5.9.14· Vendor fix available
    Issue
    Versions of tf2-item-format since at least 4.2.6 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. Tested Versions - 5.9.13 - 5.8.10 - 5.7.0 - 5.6.17 - 4.3.5 - 4.2.6 v5 Upgrade package to ^5.9.14 v4 No patch exists. Please consult the v4 to v5 migration guide to upgrade to v5. If upgrading to v5 is not possible, fork the module repository and implement the fix detailed below. Impact This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any tf2-item-format to parse user input.

    Recommended action: Upgrade to 5.9.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →