AIKIDO-2025-10566

TL;DR

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to an inefficient regex pattern in the last_years matcher, which allowed catastrophic backtracking. An attacker could exploit this by crafting malicious input like 'last ' + '1'.repeat(100) + ' years', causing exponential backtracking that stalls the event loop and leads to denial of service. This occurs because the original pattern ambiguously splits digits between d* and d+ when no decimal is present, creating excessive computation paths.