NodeJS/vue/2.6.7
The progressive JavaScript framework for building modern web UI.
https://www.npmjs.com/package/vue
MIT
1 Security Vulnerabilities
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
Published date: 2024-10-15T18:30:50Z
CVE: CVE-2024-9506
Links:
The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.
To demonstrate this vulnerability, here's an example. In a Vue client-side application, create a new Vue instance with a template string that includes a <script> tag but closes it incorrectly with something like </textarea>.
new Vue({
el: '#app',
template: '
<div>
Hello, world!
<script>${'<'.repeat(1000000)}</textarea>
</div>'
});
Next, set up a basic HTML page (e.g., index.html) to load this JavaScript and mount the Vue instance:
<!DOCTYPE html>
<html>
<head>
<title>My first Vue app</title>
</head>
<body>
<div id=\"app\">Loading...</div>
</body>
</html>
When you visit the app in your browser at http://localhost:3000, you'll notice that the time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.
Affected versions:
["2.0.0-alpha.1", "2.0.0-alpha.2", "2.0.0-alpha.3", "2.0.0-alpha.4", "2.0.0-alpha.5", "2.0.0-alpha.6", "2.0.0-alpha.7", "2.0.0-alpha.8", "2.0.0-beta.1", "2.0.0-beta.2", "2.0.0-beta.3", "2.0.0-beta.4", "2.0.0-beta.5", "2.0.0-beta.6", "2.0.0-beta.7", "2.0.0-beta.8", "2.0.0-rc.1", "2.0.0-rc.2", "2.0.0-rc.3", "2.0.0-rc.4", "2.0.0-rc.5", "2.0.0-rc.6", "2.0.0-rc.7", "2.0.0-rc.8", "2.0.0", "2.0.1", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.1.6", "2.1.7", "2.1.8", "2.1.9", "2.1.10", "2.2.0-beta.1", "2.2.0-beta.2", "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.2.5", "2.2.6", "2.3.0-beta.1", "2.3.0", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.4.0", "2.4.1", "2.4.2", "2.4.3", "2.4.4", "2.5.0", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.5.6", "2.5.7", "2.5.8", "2.5.9", "2.5.10", "2.5.11", "2.5.12", "2.5.13", "2.5.14", "2.5.15", "2.5.16", "2.5.17-beta.0", "2.5.17", "2.5.18-beta.0", "2.5.18", "2.5.19", "2.5.20", "2.5.21", "2.5.22", "2.6.0-beta.1", "2.6.0-beta.2", "2.6.0-beta.3", "2.6.0", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.8", "2.6.9", "2.6.10", "2.6.11", "2.6.12", "2.6.13", "2.6.14", "2.7.0-alpha.1", "2.7.0-alpha.2", "2.7.0-alpha.3", "2.7.0-alpha.4", "2.7.0-alpha.5", "2.7.0-alpha.6", "2.7.0-alpha.7", "2.7.0-alpha.8", "2.7.0-alpha.9", "2.7.0-alpha.10", "2.7.0-alpha.11", "2.7.0-alpha.12", "2.7.0-beta.1", "2.7.0-beta.2", "2.7.0-beta.3", "2.7.0-beta.4", "2.7.0-beta.5", "2.7.0-beta.6", "2.7.0-beta.7", "2.7.0-beta.8", "2.7.0", "2.7.1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.10", "2.7.11", "2.7.12", "2.7.13", "2.7.14", "2.7.15", "2.7.16-beta.1", "2.7.16-beta.2", "2.7.16"]
Secure versions:
[0.0.0, 0.6.0, 0.7.0, 0.7.1, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.6, 0.8.7, 0.8.8, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.11.0-rc, 0.11.0-rc2, 0.11.0-rc3, 0.11.0, 0.11.1, 0.11.2, 0.11.3, 0.11.4, 0.11.5, 0.11.6, 0.11.7, 0.11.8, 0.11.9, 0.11.10, 0.12.0-beta1, 0.12.0-beta2, 0.12.0-beta3, 0.12.0-beta4, 0.12.0-beta5, 0.12.0-rc, 0.12.0-rc2, 0.12.0, 0.12.0-csp, 0.12.1, 0.12.1-csp, 0.12.1-csp.1, 0.12.1-csp.2, 0.12.2, 0.12.3, 0.12.4, 0.12.5, 0.12.5-csp, 0.12.6, 0.12.6-csp, 0.12.7, 0.12.7-csp, 0.12.8, 0.12.8-csp, 0.12.9, 0.12.9-csp, 0.12.10, 0.12.10-csp, 0.12.11, 0.12.11-csp, 0.12.12, 0.12.12-csp, 1.0.0-alpha.1, 1.0.0-alpha.2, 0.12.13, 0.12.13-csp, 1.0.0-alpha.3, 0.12.14, 0.12.14-csp, 1.0.0-alpha.4, 0.12.15, 0.12.15-csp, 1.0.0-alpha.5, 1.0.0-beta.1, 0.12.16, 0.12.16-csp, 1.0.0-alpha.6, 1.0.0-beta.2, 1.0.0-alpha.7, 1.0.0-beta.3, 1.0.0-alpha.8, 1.0.0-beta.4, 1.0.0-rc.1, 1.0.0-rc.2-migration, 1.0.0-rc.2, 1.0.0-csp, 1.0.0-migration, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.10-csp, 1.0.11, 1.0.11-csp, 1.0.12, 1.0.12-csp, 1.0.12-csp-1, 1.0.13, 1.0.13-csp, 1.0.14, 1.0.14-csp, 1.0.15, 1.0.15-csp, 1.0.16, 1.0.16-csp, 1.0.17, 1.0.17-csp, 1.0.18, 1.0.18-csp, 1.0.19, 1.0.19-csp, 1.0.20, 1.0.20-csp, 1.0.21, 1.0.21-csp, 1.0.22, 1.0.22-csp, 1.0.23, 1.0.23-csp, 1.0.24, 1.0.24-csp, 1.0.25, 1.0.25-csp, 1.0.26, 1.0.26-csp, 1.0.27, 1.0.27-csp, 1.0.28, 1.0.28-csp, 3.0.0-alpha.0, 3.0.0-alpha.1, 3.0.0-alpha.2, 3.0.0-alpha.3, 3.0.0-alpha.4, 3.0.0-alpha.5, 3.0.0-alpha.6, 3.0.0-alpha.7, 3.0.0-alpha.8, 3.0.0-alpha.9, 3.0.0-alpha.10, 3.0.0-alpha.11, 3.0.0-alpha.12, 3.0.0-alpha.13, 3.0.0-beta.1, 3.0.0-beta.2, 3.0.0-beta.3, 3.0.0-beta.4, 3.0.0-beta.5, 3.0.0-beta.6, 3.0.0-beta.7, 3.0.0-beta.8, 3.0.0-beta.9, 3.0.0-beta.10, 3.0.0-beta.11, 3.0.0-beta.12, 3.0.0-beta.13, 3.0.0-beta.14, 3.0.0-beta.15, 3.0.0-beta.16, 3.0.0-beta.17, 3.0.0-beta.18, 3.0.0-beta.19, 3.0.0-beta.20, 3.0.0-beta.21, 3.0.0-beta.22, 3.0.0-beta.23, 3.0.0-beta.24, 3.0.0-rc.1, 3.0.0-rc.2, 3.0.0-rc.3, 3.0.0-rc.4, 3.0.0-rc.5, 3.0.0-rc.6, 3.0.0-rc.7, 3.0.0-rc.8, 3.0.0-rc.9, 3.0.0-rc.10, 3.0.0-rc.11, 3.0.0-rc.12, 3.0.0-rc.13, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.1.0-beta.1, 3.1.0-beta.2, 3.1.0-beta.3, 3.1.0-beta.4, 3.1.0-beta.5, 3.1.0-beta.6, 3.1.0-beta.7, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.2.0-beta.1, 3.2.0-beta.2, 3.2.0-beta.3, 3.2.0-beta.4, 3.2.0-beta.5, 3.2.0-beta.6, 3.2.0-beta.7, 3.2.0-beta.8, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.2.10, 3.2.11, 3.2.12, 3.2.13, 3.2.14, 3.2.15, 3.2.16, 3.2.17, 3.2.18, 3.2.19, 3.2.20, 3.2.21, 3.2.22, 3.2.23, 3.2.24, 3.2.25, 3.2.26, 3.2.27, 3.2.28, 3.2.29, 3.2.30, 3.2.31, 3.2.32, 3.2.33, 3.2.34-beta.1, 3.2.34, 3.2.35, 3.2.36, 3.2.37, 3.2.38, 3.2.39, 3.2.40, 3.2.41, 3.2.42, 3.2.43, 3.2.44, 3.2.45, 3.2.46, 3.2.47, 3.3.0-alpha.1, 3.3.0-alpha.2, 3.3.0-alpha.3, 3.3.0-alpha.4, 3.3.0-alpha.5, 3.3.0-alpha.6, 3.3.0-alpha.7, 3.3.0-alpha.8, 3.3.0-alpha.9, 3.3.0-alpha.10, 3.3.0-alpha.11, 3.3.0-alpha.12, 3.3.0-alpha.13, 3.3.0-beta.1, 3.3.0-beta.2, 3.3.0-beta.3, 3.3.0-beta.4, 3.3.0-beta.5, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.4.0-alpha.1, 3.3.8, 3.3.9, 3.4.0-alpha.2, 3.4.0-alpha.3, 3.3.10, 3.4.0-alpha.4, 3.3.11, 3.4.0-beta.1, 3.4.0-beta.2, 3.3.12, 3.4.0-beta.3, 3.3.13, 3.4.0-beta.4, 3.4.0-rc.1, 3.4.0-rc.2, 3.4.0-rc.3, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.9, 3.4.10, 3.4.11, 3.4.12, 3.4.13, 3.4.14, 3.4.15, 3.4.16, 3.4.17, 3.4.18, 3.4.19, 3.4.20, 3.4.21, 3.4.22, 3.4.23, 3.4.24, 3.4.25, 3.5.0-alpha.1, 3.4.26, 3.5.0-alpha.2, 3.4.27, 3.4.28, 3.4.29, 3.4.30, 3.4.31, 3.4.32, 3.4.33, 3.5.0-alpha.3, 3.4.34, 3.5.0-alpha.4, 3.4.35, 3.5.0-alpha.5, 3.4.36, 3.4.37, 3.5.0-beta.1, 3.5.0-beta.2, 3.4.38, 3.5.0-beta.3, 3.5.0-rc.1, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9, 3.5.10, 3.5.11, 3.5.12]
Recommendation:
Update to version 3.5.12.
530 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 2.5.17 | MIT | 1 | 2018-08-01 - 19:31 | over 6 years |
| 2.5.17-beta.0 | MIT | 1 | 2018-03-23 - 23:29 | over 6 years |
| 2.5.16 | MIT | 1 | 2018-03-13 - 22:14 | over 6 years |
| 2.5.15 | MIT | 1 | 2018-03-10 - 23:36 | over 6 years |
| 2.5.14 | MIT | 1 | 2018-03-09 - 21:42 | over 6 years |
| 2.5.13 | MIT | 1 | 2017-12-19 - 19:07 | almost 7 years |
| 2.5.12 | MIT | 1 | 2017-12-19 - 14:54 | almost 7 years |
| 2.5.11 | MIT | 1 | 2017-12-14 - 16:56 | almost 7 years |
| 2.5.10 | MIT | 1 | 2017-12-12 - 23:16 | almost 7 years |
| 2.5.9 | MIT | 1 | 2017-11-27 - 17:43 | almost 7 years |
| 2.5.8 | MIT | 1 | 2017-11-21 - 14:42 | almost 7 years |
| 2.5.7 | MIT | 1 | 2017-11-20 - 19:49 | almost 7 years |
| 2.5.6 | MIT | 1 | 2017-11-18 - 19:44 | almost 7 years |
| 2.5.5 | MIT | 1 | 2017-11-17 - 16:37 | almost 7 years |
| 2.5.4 | MIT | 1 | 2017-11-16 - 19:55 | almost 7 years |
| 2.5.3 | MIT | 1 | 2017-11-03 - 21:11 | almost 7 years |
| 2.5.2 | MIT | 1 | 2017-10-13 - 20:21 | about 7 years |
| 2.5.1 | MIT | 1 | 2017-10-13 - 14:14 | about 7 years |
| 2.5.0 | MIT | 1 | 2017-10-13 - 03:07 | about 7 years |
| 2.4.4 | MIT | 1 | 2017-09-14 - 15:32 | about 7 years |
| 2.4.3 | MIT | 1 | 2017-09-13 - 07:57 | about 7 years |
| 2.4.2 | MIT | 1 | 2017-07-21 - 04:28 | over 7 years |
| 2.4.1 | MIT | 1 | 2017-07-13 - 06:40 | over 7 years |
| 2.4.0 | MIT | 1 | 2017-07-13 - 05:59 | over 7 years |
| 2.3.4 | MIT | 1 | 2017-06-08 - 04:54 | over 7 years |
| 2.3.3 | MIT | 1 | 2017-05-09 - 16:57 | over 7 years |
| 2.3.2 | MIT | 1 | 2017-05-02 - 10:30 | over 7 years |
| 2.3.1 | MIT | 1 | 2017-05-02 - 07:59 | over 7 years |
| 2.3.0 | MIT | 1 | 2017-04-27 - 06:22 | over 7 years |
| 2.3.0-beta.1 | MIT | 1 | 2017-04-26 - 10:32 | over 7 years |
| 2.2.6 | MIT | 1 | 2017-03-27 - 02:46 | over 7 years |
| 2.2.5 | MIT | 1 | 2017-03-24 - 04:53 | over 7 years |
| 2.2.4 | MIT | 1 | 2017-03-13 - 15:08 | over 7 years |
| 2.2.3 | MIT | 1 | 2017-03-13 - 08:08 | over 7 years |
| 2.2.2 | MIT | 1 | 2017-03-09 - 04:23 | over 7 years |
| 2.2.1 | MIT | 1 | 2017-02-26 - 13:10 | over 7 years |
| 2.2.0 | MIT | 1 | 2017-02-26 - 04:32 | over 7 years |
| 2.2.0-beta.2 | MIT | 1 | 2017-02-25 - 00:01 | over 7 years |
| 2.2.0-beta.1 | MIT | 1 | 2017-02-24 - 04:22 | over 7 years |
| 2.1.10 | MIT | 1 | 2017-01-17 - 17:17 | almost 8 years |
| 2.1.9 | MIT | 1 | 2017-01-16 - 23:48 | almost 8 years |
| 2.1.8 | MIT | 1 | 2016-12-28 - 05:54 | almost 8 years |
| 2.1.7 | MIT | 1 | 2016-12-24 - 16:36 | almost 8 years |
| 2.1.6 | MIT | 1 | 2016-12-13 - 17:22 | almost 8 years |
| 2.1.5 | MIT | 1 | 2016-12-13 - 03:09 | almost 8 years |
| 2.1.4 | MIT | 1 | 2016-12-02 - 03:01 | almost 8 years |
| 2.1.3 | MIT | 1 | 2016-11-24 - 00:22 | almost 8 years |
| 2.1.2 | MIT | 1 | 2016-11-23 - 23:42 | almost 8 years |
| 2.1.1 | MIT | 1 | 2016-11-23 - 21:00 | almost 8 years |
| 2.1.0 | MIT | 1 | 2016-11-22 - 16:15 | almost 8 years |
| 2.0.8 | MIT | 1 | 2016-11-20 - 03:15 | almost 8 years |
| 2.0.7 | MIT | 1 | 2016-11-16 - 21:54 | almost 8 years |
| 2.0.6 | MIT | 1 | 2016-11-15 - 23:05 | almost 8 years |
| 2.0.5 | MIT | 1 | 2016-11-05 - 03:47 | almost 8 years |
| 2.0.4 | MIT | 1 | 2016-11-04 - 20:47 | almost 8 years |
| 2.0.3 | MIT | 1 | 2016-10-13 - 09:27 | about 8 years |
| 2.0.2 | MIT | 1 | 2016-10-12 - 04:54 | about 8 years |
| 2.0.1 | MIT | 1 | 2016-09-30 - 21:12 | about 8 years |
| 2.0.0 | MIT | 1 | 2016-09-30 - 18:32 | about 8 years |
| 2.0.0-rc.8 | MIT | 1 | 2016-09-27 - 21:08 | about 8 years |
| 2.0.0-rc.7 | MIT | 1 | 2016-09-23 - 22:24 | about 8 years |
| 2.0.0-rc.6 | MIT | 1 | 2016-09-13 - 13:21 | about 8 years |
| 2.0.0-rc.5 | MIT | 1 | 2016-09-08 - 11:30 | about 8 years |
| 2.0.0-rc.4 | MIT | 1 | 2016-08-29 - 19:49 | about 8 years |
| 2.0.0-rc.3 | MIT | 1 | 2016-08-20 - 18:05 | about 8 years |
| 2.0.0-rc.2 | MIT | 1 | 2016-08-16 - 03:39 | about 8 years |
| 2.0.0-rc.1 | MIT | 1 | 2016-08-11 - 05:43 | about 8 years |
| 2.0.0-beta.8 | MIT | 1 | 2016-08-10 - 04:55 | about 8 years |
| 2.0.0-beta.7 | MIT | 1 | 2016-08-05 - 22:10 | about 8 years |
| 2.0.0-beta.6 | MIT | 1 | 2016-08-01 - 19:27 | over 8 years |
| 2.0.0-beta.5 | MIT | 1 | 2016-07-27 - 04:25 | over 8 years |
| 2.0.0-beta.4 | MIT | 1 | 2016-07-26 - 02:04 | over 8 years |
| 2.0.0-beta.3 | MIT | 1 | 2016-07-24 - 02:45 | over 8 years |
| 2.0.0-beta.2 | MIT | 1 | 2016-07-17 - 05:51 | over 8 years |
| 2.0.0-beta.1 | MIT | 1 | 2016-07-07 - 21:51 | over 8 years |
| 2.0.0-alpha.8 | MIT | 1 | 2016-06-28 - 09:02 | over 8 years |
| 2.0.0-alpha.7 | MIT | 1 | 2016-06-28 - 02:24 | over 8 years |
| 2.0.0-alpha.6 | MIT | 1 | 2016-06-22 - 19:33 | over 8 years |
| 2.0.0-alpha.5 | MIT | 1 | 2016-06-17 - 18:22 | over 8 years |
| 2.0.0-alpha.4 | MIT | 1 | 2016-06-16 - 17:00 | over 8 years |
| 2.0.0-alpha.3 | MIT | 1 | 2016-06-15 - 18:22 | over 8 years |
| 2.0.0-alpha.2 | MIT | 1 | 2016-06-13 - 23:36 | over 8 years |
| 2.0.0-alpha.1 | MIT | 1 | 2016-06-10 - 23:34 | over 8 years |
| 1.0.28 | MIT | 2016-09-27 - 20:45 | about 8 years | |
| 1.0.28-csp | MIT | 2016-09-27 - 20:47 | about 8 years | |
| 1.0.27 | MIT | 2016-09-23 - 19:51 | about 8 years | |
| 1.0.27-csp | MIT | 2016-09-23 - 19:53 | about 8 years | |
| 1.0.26 | MIT | 2016-06-28 - 20:57 | over 8 years | |
| 1.0.26-csp | MIT | 2016-06-28 - 21:42 | over 8 years | |
| 1.0.25 | MIT | 2016-06-16 - 22:29 | over 8 years | |
| 1.0.25-csp | MIT | 2016-06-16 - 22:37 | over 8 years | |
| 1.0.24 | MIT | 2016-05-11 - 21:57 | over 8 years | |
| 1.0.24-csp | MIT | 2016-05-11 - 21:59 | over 8 years | |
| 1.0.23 | MIT | 2016-05-11 - 16:20 | over 8 years | |
| 1.0.23-csp | MIT | 2016-05-11 - 16:22 | over 8 years | |
| 1.0.22 | MIT | 2016-05-07 - 21:59 | over 8 years | |
| 1.0.22-csp | MIT | 2016-05-07 - 22:00 | over 8 years | |
| 1.0.21 | MIT | 2016-04-07 - 22:08 | over 8 years | |
| 1.0.21-csp | MIT | 2016-04-07 - 22:11 | over 8 years | |
| 1.0.20 | MIT | 2016-03-26 - 21:20 | over 8 years |