Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Underscore.string Unescape HTML Can Be Slow or Crash
published 7 years ago
Summary
Versions of underscore.string before 3.3.5 can cause your website to slow down or crash if it receives a very long or malicious input. This is due to a flaw in the unescapeHTML function. To fix, update to version 3.3.5 or later.
What to do
- Update esamatti underscore.string to version 3.3.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | esamatti | underscore.string |
< 3.3.5 Fix: upgrade to 3.3.5
|
Original advisory text
Regular Expression Denial of Service in underscore.string
Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS).
The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.
## Recommendation
Upgrade to version 3.3.5 or higher.
The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.
## Recommendation
Upgrade to version 3.3.5 or higher.
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published14 Jun 2019
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-v2p6-4mp7-3r9v · GHSA
Track software like this
Free during beta