AIKIDO-2026-10260

TL;DR

Affected versions of this package allow user-controlled regular expression patterns to be processed with insufficient safeguards against catastrophic backtracking, potentially enabling Regular Expression Denial of Service (ReDoS). Although checks attempt to reject overly long patterns and certain nested quantifiers, incomplete validation may still permit crafted patterns that bypass detection. An attacker could supply specially designed regex input that triggers excessive CPU consumption during evaluation, causing application slowdown or service disruption when the pattern is executed against large or complex input.