AIKIDO-2026-935934

strnum is vulnerable to Regular Expression Denial of Service (ReDoS)

Regular Expression Denial of Service (ReDoS)GHSA-w2f6-j622-j3mg Published 3 days ago

Medium Risk

This Affects:

strnum

0.0.1 - 2.4.1

Fixed in 2.4.2

Are you affected? Scan for Free

TL;DR

The toNumber parser calls trimZeros unconditionally, which strips trailing zeros with a regular expression. On a decimal string that has a long run of zeros followed by a later non-zero digit, the regex backtracks once per zero. A small crafted input passed to the parser can therefore consume excessive CPU and stall the event loop, including when reached indirectly through consumers that parse untrusted values. The fix replaces the regex with a linear backward scan that produces identical output without the resource exhaustion.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted strings to toNumber, directly or through a consumer such as an XML parser.