ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packaging | May 4, 2022 | Mar 12, 2021 | |
| Alpine Linux | alpine-linux-upgrade-nodejs | Oct 1, 2024 | Mar 12, 2021 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Mar 12, 2021 | |
| Centos_linux | — | centos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-docscentos-upgrade-nodejs-full-i18ncentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-npm | Aug 12, 2021 | Mar 12, 2021 |
| Debian | debian-upgrade-node-ssri | Jul 30, 2024 | Mar 12, 2021 | |
| Freebsd | freebsd-upgrade-package-node14freebsd-upgrade-package-node | Nov 4, 2022 | Sep 21, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-runtime-nodejs-14-17-6-11-4-38-0-1-101-2oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-12-12-22-5-11-4-38-0-1-101-2oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-14-14-17-6-11-4-38-0-1-101-2 | Nov 17, 2021 | Mar 12, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-npm | Aug 12, 2021 | Mar 12, 2021 |
| Redhat_linux | redhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-npm | Aug 12, 2021 | Mar 12, 2021 | |
| Rocky_linux | rocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-npm | May 5, 2022 | Mar 12, 2021 | |
| Suse | — | suse-upgrade-nodejs-commonsuse-upgrade-nodejs10suse-upgrade-nodejs10-develsuse-upgrade-nodejs10-docssuse-upgrade-nodejs12suse-upgrade-nodejs12-develsuse-upgrade-nodejs12-docssuse-upgrade-nodejs14suse-upgrade-nodejs14-develsuse-upgrade-nodejs14-docssuse-upgrade-nodejs8suse-upgrade-nodejs8-develsuse-upgrade-nodejs8-docssuse-upgrade-npm10suse-upgrade-npm12suse-upgrade-npm14suse-upgrade-npm8 | Jul 15, 2021 | Mar 12, 2021 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Mar 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub