NodeJS/vue/2.2.6
The progressive JavaScript framework for building modern web UI.
https://www.npmjs.com/package/vue
MIT
1 Security Vulnerabilities
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
Published date: 2024-10-15T18:30:50Z
CVE: CVE-2024-9506
Links:
The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.
To demonstrate this vulnerability, here's an example. In a Vue client-side application, create a new Vue instance with a template string that includes a <script> tag but closes it incorrectly with something like </textarea>.
new Vue({
el: '#app',
template: '
<div>
Hello, world!
<script>${'<'.repeat(1000000)}</textarea>
</div>'
});
Next, set up a basic HTML page (e.g., index.html) to load this JavaScript and mount the Vue instance:
<!DOCTYPE html>
<html>
<head>
<title>My first Vue app</title>
</head>
<body>
<div id=\"app\">Loading...</div>
</body>
</html>
When you visit the app in your browser at http://localhost:3000, you'll notice that the time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.
Affected versions:
["2.0.0-alpha.1", "2.0.0-alpha.2", "2.0.0-alpha.3", "2.0.0-alpha.4", "2.0.0-alpha.5", "2.0.0-alpha.6", "2.0.0-alpha.7", "2.0.0-alpha.8", "2.0.0-beta.1", "2.0.0-beta.2", "2.0.0-beta.3", "2.0.0-beta.4", "2.0.0-beta.5", "2.0.0-beta.6", "2.0.0-beta.7", "2.0.0-beta.8", "2.0.0-rc.1", "2.0.0-rc.2", "2.0.0-rc.3", "2.0.0-rc.4", "2.0.0-rc.5", "2.0.0-rc.6", "2.0.0-rc.7", "2.0.0-rc.8", "2.0.0", "2.0.1", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.1.6", "2.1.7", "2.1.8", "2.1.9", "2.1.10", "2.2.0-beta.1", "2.2.0-beta.2", "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.2.5", "2.2.6", "2.3.0-beta.1", "2.3.0", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.4.0", "2.4.1", "2.4.2", "2.4.3", "2.4.4", "2.5.0", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.5.6", "2.5.7", "2.5.8", "2.5.9", "2.5.10", "2.5.11", "2.5.12", "2.5.13", "2.5.14", "2.5.15", "2.5.16", "2.5.17-beta.0", "2.5.17", "2.5.18-beta.0", "2.5.18", "2.5.19", "2.5.20", "2.5.21", "2.5.22", "2.6.0-beta.1", "2.6.0-beta.2", "2.6.0-beta.3", "2.6.0", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.8", "2.6.9", "2.6.10", "2.6.11", "2.6.12", "2.6.13", "2.6.14", "2.7.0-alpha.1", "2.7.0-alpha.2", "2.7.0-alpha.3", "2.7.0-alpha.4", "2.7.0-alpha.5", "2.7.0-alpha.6", "2.7.0-alpha.7", "2.7.0-alpha.8", "2.7.0-alpha.9", "2.7.0-alpha.10", "2.7.0-alpha.11", "2.7.0-alpha.12", "2.7.0-beta.1", "2.7.0-beta.2", "2.7.0-beta.3", "2.7.0-beta.4", "2.7.0-beta.5", "2.7.0-beta.6", "2.7.0-beta.7", "2.7.0-beta.8", "2.7.0", "2.7.1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.10", "2.7.11", "2.7.12", "2.7.13", "2.7.14", "2.7.15", "2.7.16-beta.1", "2.7.16-beta.2", "2.7.16"]
Secure versions:
[0.0.0, 0.6.0, 0.7.0, 0.7.1, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.6, 0.8.7, 0.8.8, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.11.0-rc, 0.11.0-rc2, 0.11.0-rc3, 0.11.0, 0.11.1, 0.11.2, 0.11.3, 0.11.4, 0.11.5, 0.11.6, 0.11.7, 0.11.8, 0.11.9, 0.11.10, 0.12.0-beta1, 0.12.0-beta2, 0.12.0-beta3, 0.12.0-beta4, 0.12.0-beta5, 0.12.0-rc, 0.12.0-rc2, 0.12.0, 0.12.0-csp, 0.12.1, 0.12.1-csp, 0.12.1-csp.1, 0.12.1-csp.2, 0.12.2, 0.12.3, 0.12.4, 0.12.5, 0.12.5-csp, 0.12.6, 0.12.6-csp, 0.12.7, 0.12.7-csp, 0.12.8, 0.12.8-csp, 0.12.9, 0.12.9-csp, 0.12.10, 0.12.10-csp, 0.12.11, 0.12.11-csp, 0.12.12, 0.12.12-csp, 1.0.0-alpha.1, 1.0.0-alpha.2, 0.12.13, 0.12.13-csp, 1.0.0-alpha.3, 0.12.14, 0.12.14-csp, 1.0.0-alpha.4, 0.12.15, 0.12.15-csp, 1.0.0-alpha.5, 1.0.0-beta.1, 0.12.16, 0.12.16-csp, 1.0.0-alpha.6, 1.0.0-beta.2, 1.0.0-alpha.7, 1.0.0-beta.3, 1.0.0-alpha.8, 1.0.0-beta.4, 1.0.0-rc.1, 1.0.0-rc.2-migration, 1.0.0-rc.2, 1.0.0-csp, 1.0.0-migration, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.10-csp, 1.0.11, 1.0.11-csp, 1.0.12, 1.0.12-csp, 1.0.12-csp-1, 1.0.13, 1.0.13-csp, 1.0.14, 1.0.14-csp, 1.0.15, 1.0.15-csp, 1.0.16, 1.0.16-csp, 1.0.17, 1.0.17-csp, 1.0.18, 1.0.18-csp, 1.0.19, 1.0.19-csp, 1.0.20, 1.0.20-csp, 1.0.21, 1.0.21-csp, 1.0.22, 1.0.22-csp, 1.0.23, 1.0.23-csp, 1.0.24, 1.0.24-csp, 1.0.25, 1.0.25-csp, 1.0.26, 1.0.26-csp, 1.0.27, 1.0.27-csp, 1.0.28, 1.0.28-csp, 3.0.0-alpha.0, 3.0.0-alpha.1, 3.0.0-alpha.2, 3.0.0-alpha.3, 3.0.0-alpha.4, 3.0.0-alpha.5, 3.0.0-alpha.6, 3.0.0-alpha.7, 3.0.0-alpha.8, 3.0.0-alpha.9, 3.0.0-alpha.10, 3.0.0-alpha.11, 3.0.0-alpha.12, 3.0.0-alpha.13, 3.0.0-beta.1, 3.0.0-beta.2, 3.0.0-beta.3, 3.0.0-beta.4, 3.0.0-beta.5, 3.0.0-beta.6, 3.0.0-beta.7, 3.0.0-beta.8, 3.0.0-beta.9, 3.0.0-beta.10, 3.0.0-beta.11, 3.0.0-beta.12, 3.0.0-beta.13, 3.0.0-beta.14, 3.0.0-beta.15, 3.0.0-beta.16, 3.0.0-beta.17, 3.0.0-beta.18, 3.0.0-beta.19, 3.0.0-beta.20, 3.0.0-beta.21, 3.0.0-beta.22, 3.0.0-beta.23, 3.0.0-beta.24, 3.0.0-rc.1, 3.0.0-rc.2, 3.0.0-rc.3, 3.0.0-rc.4, 3.0.0-rc.5, 3.0.0-rc.6, 3.0.0-rc.7, 3.0.0-rc.8, 3.0.0-rc.9, 3.0.0-rc.10, 3.0.0-rc.11, 3.0.0-rc.12, 3.0.0-rc.13, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.1.0-beta.1, 3.1.0-beta.2, 3.1.0-beta.3, 3.1.0-beta.4, 3.1.0-beta.5, 3.1.0-beta.6, 3.1.0-beta.7, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.2.0-beta.1, 3.2.0-beta.2, 3.2.0-beta.3, 3.2.0-beta.4, 3.2.0-beta.5, 3.2.0-beta.6, 3.2.0-beta.7, 3.2.0-beta.8, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.2.10, 3.2.11, 3.2.12, 3.2.13, 3.2.14, 3.2.15, 3.2.16, 3.2.17, 3.2.18, 3.2.19, 3.2.20, 3.2.21, 3.2.22, 3.2.23, 3.2.24, 3.2.25, 3.2.26, 3.2.27, 3.2.28, 3.2.29, 3.2.30, 3.2.31, 3.2.32, 3.2.33, 3.2.34-beta.1, 3.2.34, 3.2.35, 3.2.36, 3.2.37, 3.2.38, 3.2.39, 3.2.40, 3.2.41, 3.2.42, 3.2.43, 3.2.44, 3.2.45, 3.2.46, 3.2.47, 3.3.0-alpha.1, 3.3.0-alpha.2, 3.3.0-alpha.3, 3.3.0-alpha.4, 3.3.0-alpha.5, 3.3.0-alpha.6, 3.3.0-alpha.7, 3.3.0-alpha.8, 3.3.0-alpha.9, 3.3.0-alpha.10, 3.3.0-alpha.11, 3.3.0-alpha.12, 3.3.0-alpha.13, 3.3.0-beta.1, 3.3.0-beta.2, 3.3.0-beta.3, 3.3.0-beta.4, 3.3.0-beta.5, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.4.0-alpha.1, 3.3.8, 3.3.9, 3.4.0-alpha.2, 3.4.0-alpha.3, 3.3.10, 3.4.0-alpha.4, 3.3.11, 3.4.0-beta.1, 3.4.0-beta.2, 3.3.12, 3.4.0-beta.3, 3.3.13, 3.4.0-beta.4, 3.4.0-rc.1, 3.4.0-rc.2, 3.4.0-rc.3, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.9, 3.4.10, 3.4.11, 3.4.12, 3.4.13, 3.4.14, 3.4.15, 3.4.16, 3.4.17, 3.4.18, 3.4.19, 3.4.20, 3.4.21, 3.4.22, 3.4.23, 3.4.24, 3.4.25, 3.5.0-alpha.1, 3.4.26, 3.5.0-alpha.2, 3.4.27, 3.4.28, 3.4.29, 3.4.30, 3.4.31, 3.4.32, 3.4.33, 3.5.0-alpha.3, 3.4.34, 3.5.0-alpha.4, 3.4.35, 3.5.0-alpha.5, 3.4.36, 3.4.37, 3.5.0-beta.1, 3.5.0-beta.2, 3.4.38, 3.5.0-beta.3, 3.5.0-rc.1, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9, 3.5.10, 3.5.11, 3.5.12]
Recommendation:
Update to version 3.5.12.
530 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 1.0.20-csp | MIT | 2016-03-26 - 21:24 | over 8 years | |
| 1.0.19 | MIT | 2016-03-25 - 07:19 | over 8 years | |
| 1.0.19-csp | MIT | 2016-03-25 - 07:24 | over 8 years | |
| 1.0.18 | MIT | 2016-03-18 - 00:37 | over 8 years | |
| 1.0.18-csp | MIT | 2016-03-18 - 00:54 | over 8 years | |
| 1.0.17 | MIT | 2016-02-29 - 01:17 | over 8 years | |
| 1.0.17-csp | MIT | 2016-02-29 - 02:24 | over 8 years | |
| 1.0.16 | MIT | 2016-01-30 - 09:41 | almost 9 years | |
| 1.0.16-csp | MIT | 2016-01-30 - 10:38 | almost 9 years | |
| 1.0.15 | MIT | 2016-01-18 - 19:43 | almost 9 years | |
| 1.0.15-csp | MIT | 2016-01-18 - 19:52 | almost 9 years | |
| 1.0.14 | MIT | 2016-01-11 - 20:12 | almost 9 years | |
| 1.0.14-csp | MIT | 2016-01-11 - 20:39 | almost 9 years | |
| 1.0.13 | MIT | 2015-12-24 - 22:39 | almost 9 years | |
| 1.0.13-csp | MIT | 2015-12-25 - 03:54 | almost 9 years | |
| 1.0.12 | MIT | 2015-12-17 - 23:12 | almost 9 years | |
| 1.0.12-csp-1 | MIT | 2015-12-18 - 21:35 | almost 9 years | |
| 1.0.12-csp | MIT | 2015-12-17 - 23:23 | almost 9 years | |
| 1.0.11 | MIT | 2015-12-10 - 05:00 | almost 9 years | |
| 1.0.11-csp | MIT | 2015-12-11 - 13:20 | almost 9 years | |
| 1.0.10 | MIT | 2015-11-23 - 19:59 | almost 9 years | |
| 1.0.10-csp | MIT | 2015-11-23 - 21:59 | almost 9 years | |
| 1.0.9 | MIT | 2015-11-23 - 19:32 | almost 9 years | |
| 1.0.8 | MIT | 2015-11-12 - 21:58 | almost 9 years | |
| 1.0.7 | MIT | 2015-11-06 - 16:38 | almost 9 years | |
| 1.0.6 | MIT | 2015-11-05 - 19:52 | almost 9 years | |
| 1.0.5 | MIT | 2015-11-05 - 19:36 | almost 9 years | |
| 1.0.4 | MIT | 2015-10-31 - 20:39 | about 9 years | |
| 1.0.3 | MIT | 2015-10-29 - 02:13 | about 9 years | |
| 1.0.2 | MIT | 2015-10-29 - 01:46 | about 9 years | |
| 1.0.1 | MIT | 2015-10-27 - 17:58 | about 9 years | |
| 1.0.0 | MIT | 2015-10-27 - 01:40 | about 9 years | |
| 1.0.0-csp | MIT | 2015-10-27 - 01:22 | about 9 years | |
| 1.0.0-rc.2 | MIT | 2015-10-23 - 00:43 | about 9 years | |
| 1.0.0-rc.2-migration | MIT | 2015-10-23 - 00:38 | about 9 years | |
| 1.0.0-rc.1 | MIT | 2015-10-15 - 21:14 | about 9 years | |
| 1.0.0-beta.4 | MIT | 2015-10-11 - 00:47 | about 9 years | |
| 1.0.0-beta.3 | MIT | 2015-10-02 - 20:17 | about 9 years | |
| 1.0.0-beta.2 | MIT | 2015-09-25 - 20:53 | about 9 years | |
| 1.0.0-beta.1 | MIT | 2015-09-21 - 19:12 | about 9 years | |
| 1.0.0-alpha.8 | MIT | 2015-10-11 - 00:38 | about 9 years | |
| 1.0.0-alpha.7 | MIT | 2015-10-02 - 20:13 | about 9 years | |
| 1.0.0-alpha.6 | MIT | 2015-09-25 - 20:34 | about 9 years | |
| 1.0.0-alpha.5 | MIT | 2015-09-19 - 22:14 | about 9 years | |
| 1.0.0-alpha.4 | MIT | 2015-09-11 - 18:27 | about 9 years | |
| 1.0.0-alpha.3 | MIT | 2015-09-07 - 20:21 | about 9 years | |
| 1.0.0-alpha.2 | MIT | 2015-09-01 - 20:24 | about 9 years | |
| 1.0.0-alpha.1 | MIT | 2015-08-31 - 20:59 | about 9 years | |
| 1.0.0-migration | MIT | 2015-10-27 - 01:31 | about 9 years | |
| 0.12.16 | MIT | 2015-09-25 - 20:20 | about 9 years | |
| 0.12.16-csp | MIT | 2015-09-25 - 20:29 | about 9 years | |
| 0.12.15 | MIT | 2015-09-19 - 21:33 | about 9 years | |
| 0.12.15-csp | MIT | 2015-09-19 - 21:39 | about 9 years | |
| 0.12.14 | MIT | 2015-09-11 - 18:16 | about 9 years | |
| 0.12.14-csp | MIT | 2015-09-11 - 18:19 | about 9 years | |
| 0.12.13 | MIT | 2015-09-07 - 20:10 | about 9 years | |
| 0.12.13-csp | MIT | 2015-09-07 - 20:15 | about 9 years | |
| 0.12.12 | MIT | 2015-08-26 - 08:48 | about 9 years | |
| 0.12.12-csp | MIT | 2015-08-26 - 09:01 | about 9 years | |
| 0.12.11 | MIT | 2015-08-25 - 16:58 | about 9 years | |
| 0.12.11-csp | MIT | 2015-08-25 - 17:10 | about 9 years | |
| 0.12.10 | MIT | 2015-08-10 - 03:39 | about 9 years | |
| 0.12.10-csp | MIT | 2015-08-10 - 03:58 | about 9 years | |
| 0.12.9 | MIT | 2015-07-31 - 20:31 | over 9 years | |
| 0.12.9-csp | MIT | 2015-07-31 - 21:10 | over 9 years | |
| 0.12.8 | MIT | 2015-07-23 - 15:23 | over 9 years | |
| 0.12.8-csp | MIT | 2015-07-23 - 18:48 | over 9 years | |
| 0.12.7 | MIT | 2015-07-07 - 18:51 | over 9 years | |
| 0.12.7-csp | MIT | 2015-07-07 - 18:54 | over 9 years | |
| 0.12.6 | MIT | 2015-07-05 - 07:48 | over 9 years | |
| 0.12.6-csp | MIT | 2015-07-05 - 08:24 | over 9 years | |
| 0.12.5 | MIT | 2015-07-02 - 15:04 | over 9 years | |
| 0.12.5-csp | MIT | 2015-07-03 - 01:11 | over 9 years | |
| 0.12.4 | MIT | 2015-06-25 - 22:26 | over 9 years | |
| 0.12.3 | MIT | 2015-06-25 - 17:38 | over 9 years | |
| 0.12.2 | MIT | 2015-06-25 - 14:51 | over 9 years | |
| 0.12.1 | MIT | 2015-06-14 - 05:28 | over 9 years | |
| 0.12.1-csp.2 | MIT | 2015-06-16 - 17:14 | over 9 years | |
| 0.12.1-csp.1 | MIT | 2015-06-16 - 17:02 | over 9 years | |
| 0.12.1-csp | MIT | 2015-06-14 - 05:56 | over 9 years | |
| 0.12.0 | MIT | 2015-06-12 - 17:34 | over 9 years | |
| 0.12.0-csp | MIT | 2015-06-12 - 20:50 | over 9 years | |
| 0.12.0-rc2 | MIT | 2015-06-04 - 19:00 | over 9 years | |
| 0.12.0-rc | MIT | 2015-06-01 - 20:56 | over 9 years | |
| 0.12.0-beta5 | MIT | 2015-05-30 - 02:27 | over 9 years | |
| 0.12.0-beta4 | MIT | 2015-05-26 - 16:51 | over 9 years | |
| 0.12.0-beta3 | MIT | 2015-05-22 - 20:08 | over 9 years | |
| 0.12.0-beta2 | MIT | 2015-05-16 - 18:22 | over 9 years | |
| 0.12.0-beta1 | MIT | 2015-05-16 - 17:25 | over 9 years | |
| 0.11.10 | MIT | 2015-05-07 - 19:00 | over 9 years | |
| 0.11.9 | MIT | 2015-05-06 - 20:40 | over 9 years | |
| 0.11.8 | MIT | 2015-04-21 - 20:10 | over 9 years | |
| 0.11.7 | MIT | 2015-04-21 - 03:19 | over 9 years | |
| 0.11.6 | MIT | 2015-04-18 - 07:11 | over 9 years | |
| 0.11.5 | MIT | 2015-02-05 - 21:29 | over 9 years | |
| 0.11.4 | MIT | 2014-12-07 - 20:44 | almost 10 years | |
| 0.11.3 | MIT | 2014-12-02 - 17:23 | almost 10 years | |
| 0.11.2 | MIT | 2014-12-02 - 02:38 | almost 10 years | |
| 0.11.1 | MIT | 2014-12-01 - 00:25 | almost 10 years | |
| 0.11.0 | MIT | 2014-11-07 - 01:52 | almost 10 years |