NodeJS/vue/2.5.14
The progressive JavaScript framework for building modern web UI.
https://www.npmjs.com/package/vue
MIT
1 Security Vulnerabilities
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
Published date: 2024-10-15T18:30:50Z
CVE: CVE-2024-9506
Links:
The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.
To demonstrate this vulnerability, here's an example. In a Vue client-side application, create a new Vue instance with a template string that includes a <script> tag but closes it incorrectly with something like </textarea>.
new Vue({
el: '#app',
template: '
<div>
Hello, world!
<script>${'<'.repeat(1000000)}</textarea>
</div>'
});
Next, set up a basic HTML page (e.g., index.html) to load this JavaScript and mount the Vue instance:
<!DOCTYPE html>
<html>
<head>
<title>My first Vue app</title>
</head>
<body>
<div id=\"app\">Loading...</div>
</body>
</html>
When you visit the app in your browser at http://localhost:3000, you'll notice that the time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.
Affected versions:
["2.0.0-alpha.1", "2.0.0-alpha.2", "2.0.0-alpha.3", "2.0.0-alpha.4", "2.0.0-alpha.5", "2.0.0-alpha.6", "2.0.0-alpha.7", "2.0.0-alpha.8", "2.0.0-beta.1", "2.0.0-beta.2", "2.0.0-beta.3", "2.0.0-beta.4", "2.0.0-beta.5", "2.0.0-beta.6", "2.0.0-beta.7", "2.0.0-beta.8", "2.0.0-rc.1", "2.0.0-rc.2", "2.0.0-rc.3", "2.0.0-rc.4", "2.0.0-rc.5", "2.0.0-rc.6", "2.0.0-rc.7", "2.0.0-rc.8", "2.0.0", "2.0.1", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.1.6", "2.1.7", "2.1.8", "2.1.9", "2.1.10", "2.2.0-beta.1", "2.2.0-beta.2", "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.2.5", "2.2.6", "2.3.0-beta.1", "2.3.0", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.4.0", "2.4.1", "2.4.2", "2.4.3", "2.4.4", "2.5.0", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.5.6", "2.5.7", "2.5.8", "2.5.9", "2.5.10", "2.5.11", "2.5.12", "2.5.13", "2.5.14", "2.5.15", "2.5.16", "2.5.17-beta.0", "2.5.17", "2.5.18-beta.0", "2.5.18", "2.5.19", "2.5.20", "2.5.21", "2.5.22", "2.6.0-beta.1", "2.6.0-beta.2", "2.6.0-beta.3", "2.6.0", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.8", "2.6.9", "2.6.10", "2.6.11", "2.6.12", "2.6.13", "2.6.14", "2.7.0-alpha.1", "2.7.0-alpha.2", "2.7.0-alpha.3", "2.7.0-alpha.4", "2.7.0-alpha.5", "2.7.0-alpha.6", "2.7.0-alpha.7", "2.7.0-alpha.8", "2.7.0-alpha.9", "2.7.0-alpha.10", "2.7.0-alpha.11", "2.7.0-alpha.12", "2.7.0-beta.1", "2.7.0-beta.2", "2.7.0-beta.3", "2.7.0-beta.4", "2.7.0-beta.5", "2.7.0-beta.6", "2.7.0-beta.7", "2.7.0-beta.8", "2.7.0", "2.7.1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.10", "2.7.11", "2.7.12", "2.7.13", "2.7.14", "2.7.15", "2.7.16-beta.1", "2.7.16-beta.2", "2.7.16"]
Secure versions:
[0.0.0, 0.6.0, 0.7.0, 0.7.1, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.6, 0.8.7, 0.8.8, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.11.0-rc, 0.11.0-rc2, 0.11.0-rc3, 0.11.0, 0.11.1, 0.11.2, 0.11.3, 0.11.4, 0.11.5, 0.11.6, 0.11.7, 0.11.8, 0.11.9, 0.11.10, 0.12.0-beta1, 0.12.0-beta2, 0.12.0-beta3, 0.12.0-beta4, 0.12.0-beta5, 0.12.0-rc, 0.12.0-rc2, 0.12.0, 0.12.0-csp, 0.12.1, 0.12.1-csp, 0.12.1-csp.1, 0.12.1-csp.2, 0.12.2, 0.12.3, 0.12.4, 0.12.5, 0.12.5-csp, 0.12.6, 0.12.6-csp, 0.12.7, 0.12.7-csp, 0.12.8, 0.12.8-csp, 0.12.9, 0.12.9-csp, 0.12.10, 0.12.10-csp, 0.12.11, 0.12.11-csp, 0.12.12, 0.12.12-csp, 1.0.0-alpha.1, 1.0.0-alpha.2, 0.12.13, 0.12.13-csp, 1.0.0-alpha.3, 0.12.14, 0.12.14-csp, 1.0.0-alpha.4, 0.12.15, 0.12.15-csp, 1.0.0-alpha.5, 1.0.0-beta.1, 0.12.16, 0.12.16-csp, 1.0.0-alpha.6, 1.0.0-beta.2, 1.0.0-alpha.7, 1.0.0-beta.3, 1.0.0-alpha.8, 1.0.0-beta.4, 1.0.0-rc.1, 1.0.0-rc.2-migration, 1.0.0-rc.2, 1.0.0-csp, 1.0.0-migration, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.10-csp, 1.0.11, 1.0.11-csp, 1.0.12, 1.0.12-csp, 1.0.12-csp-1, 1.0.13, 1.0.13-csp, 1.0.14, 1.0.14-csp, 1.0.15, 1.0.15-csp, 1.0.16, 1.0.16-csp, 1.0.17, 1.0.17-csp, 1.0.18, 1.0.18-csp, 1.0.19, 1.0.19-csp, 1.0.20, 1.0.20-csp, 1.0.21, 1.0.21-csp, 1.0.22, 1.0.22-csp, 1.0.23, 1.0.23-csp, 1.0.24, 1.0.24-csp, 1.0.25, 1.0.25-csp, 1.0.26, 1.0.26-csp, 1.0.27, 1.0.27-csp, 1.0.28, 1.0.28-csp, 3.0.0-alpha.0, 3.0.0-alpha.1, 3.0.0-alpha.2, 3.0.0-alpha.3, 3.0.0-alpha.4, 3.0.0-alpha.5, 3.0.0-alpha.6, 3.0.0-alpha.7, 3.0.0-alpha.8, 3.0.0-alpha.9, 3.0.0-alpha.10, 3.0.0-alpha.11, 3.0.0-alpha.12, 3.0.0-alpha.13, 3.0.0-beta.1, 3.0.0-beta.2, 3.0.0-beta.3, 3.0.0-beta.4, 3.0.0-beta.5, 3.0.0-beta.6, 3.0.0-beta.7, 3.0.0-beta.8, 3.0.0-beta.9, 3.0.0-beta.10, 3.0.0-beta.11, 3.0.0-beta.12, 3.0.0-beta.13, 3.0.0-beta.14, 3.0.0-beta.15, 3.0.0-beta.16, 3.0.0-beta.17, 3.0.0-beta.18, 3.0.0-beta.19, 3.0.0-beta.20, 3.0.0-beta.21, 3.0.0-beta.22, 3.0.0-beta.23, 3.0.0-beta.24, 3.0.0-rc.1, 3.0.0-rc.2, 3.0.0-rc.3, 3.0.0-rc.4, 3.0.0-rc.5, 3.0.0-rc.6, 3.0.0-rc.7, 3.0.0-rc.8, 3.0.0-rc.9, 3.0.0-rc.10, 3.0.0-rc.11, 3.0.0-rc.12, 3.0.0-rc.13, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.1.0-beta.1, 3.1.0-beta.2, 3.1.0-beta.3, 3.1.0-beta.4, 3.1.0-beta.5, 3.1.0-beta.6, 3.1.0-beta.7, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.2.0-beta.1, 3.2.0-beta.2, 3.2.0-beta.3, 3.2.0-beta.4, 3.2.0-beta.5, 3.2.0-beta.6, 3.2.0-beta.7, 3.2.0-beta.8, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.2.10, 3.2.11, 3.2.12, 3.2.13, 3.2.14, 3.2.15, 3.2.16, 3.2.17, 3.2.18, 3.2.19, 3.2.20, 3.2.21, 3.2.22, 3.2.23, 3.2.24, 3.2.25, 3.2.26, 3.2.27, 3.2.28, 3.2.29, 3.2.30, 3.2.31, 3.2.32, 3.2.33, 3.2.34-beta.1, 3.2.34, 3.2.35, 3.2.36, 3.2.37, 3.2.38, 3.2.39, 3.2.40, 3.2.41, 3.2.42, 3.2.43, 3.2.44, 3.2.45, 3.2.46, 3.2.47, 3.3.0-alpha.1, 3.3.0-alpha.2, 3.3.0-alpha.3, 3.3.0-alpha.4, 3.3.0-alpha.5, 3.3.0-alpha.6, 3.3.0-alpha.7, 3.3.0-alpha.8, 3.3.0-alpha.9, 3.3.0-alpha.10, 3.3.0-alpha.11, 3.3.0-alpha.12, 3.3.0-alpha.13, 3.3.0-beta.1, 3.3.0-beta.2, 3.3.0-beta.3, 3.3.0-beta.4, 3.3.0-beta.5, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.4.0-alpha.1, 3.3.8, 3.3.9, 3.4.0-alpha.2, 3.4.0-alpha.3, 3.3.10, 3.4.0-alpha.4, 3.3.11, 3.4.0-beta.1, 3.4.0-beta.2, 3.3.12, 3.4.0-beta.3, 3.3.13, 3.4.0-beta.4, 3.4.0-rc.1, 3.4.0-rc.2, 3.4.0-rc.3, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.9, 3.4.10, 3.4.11, 3.4.12, 3.4.13, 3.4.14, 3.4.15, 3.4.16, 3.4.17, 3.4.18, 3.4.19, 3.4.20, 3.4.21, 3.4.22, 3.4.23, 3.4.24, 3.4.25, 3.5.0-alpha.1, 3.4.26, 3.5.0-alpha.2, 3.4.27, 3.4.28, 3.4.29, 3.4.30, 3.4.31, 3.4.32, 3.4.33, 3.5.0-alpha.3, 3.4.34, 3.5.0-alpha.4, 3.4.35, 3.5.0-alpha.5, 3.4.36, 3.4.37, 3.5.0-beta.1, 3.5.0-beta.2, 3.4.38, 3.5.0-beta.3, 3.5.0-rc.1, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9, 3.5.10, 3.5.11, 3.5.12]
Recommendation:
Update to version 3.5.12.
530 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 3.0.0-beta.23 | MIT | 2020-07-16 - 16:49 | over 4 years | |
| 3.0.0-beta.22 | MIT | 2020-07-15 - 16:45 | over 4 years | |
| 3.0.0-beta.21 | MIT | 2020-07-14 - 21:18 | over 4 years | |
| 3.0.0-beta.20 | MIT | 2020-07-08 - 16:46 | over 4 years | |
| 3.0.0-beta.19 | MIT | 2020-07-07 - 14:05 | over 4 years | |
| 3.0.0-beta.18 | MIT | 2020-07-02 - 01:07 | over 4 years | |
| 3.0.0-beta.17 | MIT | 2020-06-30 - 16:09 | over 4 years | |
| 3.0.0-beta.16 | MIT | 2020-06-29 - 22:35 | over 4 years | |
| 3.0.0-beta.15 | MIT | 2020-06-12 - 22:09 | over 4 years | |
| 3.0.0-beta.14 | MIT | 2020-05-18 - 18:42 | over 4 years | |
| 3.0.0-beta.13 | MIT | 2020-05-17 - 01:54 | over 4 years | |
| 3.0.0-beta.12 | MIT | 2020-05-11 - 19:53 | over 4 years | |
| 3.0.0-beta.11 | MIT | 2020-05-11 - 18:26 | over 4 years | |
| 3.0.0-beta.10 | MIT | 2020-05-07 - 15:22 | over 4 years | |
| 3.0.0-beta.9 | MIT | 2020-05-04 - 21:15 | over 4 years | |
| 3.0.0-beta.8 | MIT | 2020-05-04 - 14:50 | over 4 years | |
| 3.0.0-beta.7 | MIT | 2020-05-02 - 21:07 | over 4 years | |
| 3.0.0-beta.6 | MIT | 2020-05-01 - 22:57 | over 4 years | |
| 3.0.0-beta.5 | MIT | 2020-04-30 - 20:21 | over 4 years | |
| 3.0.0-beta.4 | MIT | 2020-04-24 - 20:21 | over 4 years | |
| 3.0.0-beta.3 | MIT | 2020-04-20 - 21:01 | over 4 years | |
| 3.0.0-beta.2 | MIT | 2020-04-17 - 15:01 | over 4 years | |
| 3.0.0-beta.1 | MIT | 2020-04-16 - 19:46 | over 4 years | |
| 3.0.0-alpha.13 | MIT | 2020-04-15 - 16:47 | over 4 years | |
| 3.0.0-alpha.12 | MIT | 2020-04-08 - 23:00 | over 4 years | |
| 3.0.0-alpha.11 | MIT | 2020-04-04 - 01:46 | over 4 years | |
| 3.0.0-alpha.10 | MIT | 2020-03-24 - 22:34 | over 4 years | |
| 3.0.0-alpha.9 | MIT | 2020-03-16 - 22:57 | over 4 years | |
| 3.0.0-alpha.8 | MIT | 2020-03-06 - 20:59 | over 4 years | |
| 3.0.0-alpha.7 | MIT | 2020-02-26 - 19:37 | over 4 years | |
| 3.0.0-alpha.6 | MIT | 2020-02-22 - 07:26 | over 4 years | |
| 3.0.0-alpha.5 | MIT | 2020-02-18 - 20:01 | over 4 years | |
| 3.0.0-alpha.4 | MIT | 2020-01-27 - 21:20 | almost 5 years | |
| 3.0.0-alpha.3 | MIT | 2020-01-22 - 16:11 | almost 5 years | |
| 3.0.0-alpha.2 | MIT | 2020-01-13 - 22:45 | almost 5 years | |
| 3.0.0-alpha.1 | MIT | 2020-01-02 - 23:25 | almost 5 years | |
| 3.0.0-alpha.0 | MIT | 2019-12-20 - 18:40 | almost 5 years | |
| 2.7.16 | MIT | 1 | 2023-12-24 - 15:02 | 10 months |
| 2.7.16-beta.2 | MIT | 1 | 2023-12-14 - 01:28 | 11 months |
| 2.7.16-beta.1 | MIT | 1 | 2023-12-08 - 01:42 | 11 months |
| 2.7.15 | MIT | 1 | 2023-10-23 - 07:55 | about 1 year |
| 2.7.14 | MIT | 1 | 2022-11-09 - 12:40 | almost 2 years |
| 2.7.13 | MIT | 1 | 2022-10-14 - 03:42 | about 2 years |
| 2.7.12 | MIT | 1 | 2022-10-12 - 13:41 | about 2 years |
| 2.7.11 | MIT | 1 | 2022-10-11 - 11:13 | about 2 years |
| 2.7.10 | MIT | 1 | 2022-08-23 - 01:29 | about 2 years |
| 2.7.9 | MIT | 1 | 2022-08-19 - 04:27 | about 2 years |
| 2.7.8 | MIT | 1 | 2022-07-22 - 03:24 | over 2 years |
| 2.7.7 | MIT | 1 | 2022-07-16 - 14:45 | over 2 years |
| 2.7.6 | MIT | 1 | 2022-07-15 - 09:12 | over 2 years |
| 2.7.5 | MIT | 1 | 2022-07-13 - 03:08 | over 2 years |
| 2.7.4 | MIT | 1 | 2022-07-08 - 07:46 | over 2 years |
| 2.7.3 | MIT | 1 | 2022-07-06 - 05:16 | over 2 years |
| 2.7.2 | MIT | 1 | 2022-07-05 - 02:54 | over 2 years |
| 2.7.1 | MIT | 1 | 2022-07-04 - 10:38 | over 2 years |
| 2.7.0 | MIT | 1 | 2022-07-01 - 04:22 | over 2 years |
| 2.7.0-beta.8 | MIT | 1 | 2022-06-28 - 02:00 | over 2 years |
| 2.7.0-beta.7 | MIT | 1 | 2022-06-27 - 07:00 | over 2 years |
| 2.7.0-beta.6 | MIT | 1 | 2022-06-26 - 08:42 | over 2 years |
| 2.7.0-beta.5 | MIT | 1 | 2022-06-22 - 02:22 | over 2 years |
| 2.7.0-beta.4 | MIT | 1 | 2022-06-21 - 02:51 | over 2 years |
| 2.7.0-beta.3 | MIT | 1 | 2022-06-20 - 08:34 | over 2 years |
| 2.7.0-beta.2 | MIT | 1 | 2022-06-17 - 02:57 | over 2 years |
| 2.7.0-beta.1 | MIT | 1 | 2022-06-17 - 01:58 | over 2 years |
| 2.7.0-alpha.12 | MIT | 1 | 2022-06-16 - 13:53 | over 2 years |
| 2.7.0-alpha.11 | MIT | 1 | 2022-06-16 - 09:53 | over 2 years |
| 2.7.0-alpha.10 | MIT | 1 | 2022-06-16 - 09:18 | over 2 years |
| 2.7.0-alpha.9 | MIT | 1 | 2022-06-16 - 02:36 | over 2 years |
| 2.7.0-alpha.8 | MIT | 1 | 2022-06-14 - 15:46 | over 2 years |
| 2.7.0-alpha.7 | MIT | 1 | 2022-06-14 - 15:29 | over 2 years |
| 2.7.0-alpha.6 | MIT | 1 | 2022-06-09 - 06:47 | over 2 years |
| 2.7.0-alpha.5 | MIT | 1 | 2022-06-06 - 07:33 | over 2 years |
| 2.7.0-alpha.4 | MIT | 1 | 2022-06-01 - 14:19 | over 2 years |
| 2.7.0-alpha.3 | MIT | 1 | 2022-06-01 - 03:13 | over 2 years |
| 2.7.0-alpha.2 | MIT | 1 | 2022-06-01 - 02:37 | over 2 years |
| 2.7.0-alpha.1 | MIT | 1 | 2022-05-31 - 09:57 | over 2 years |
| 2.6.14 | MIT | 1 | 2021-06-07 - 09:55 | over 3 years |
| 2.6.13 | MIT | 1 | 2021-06-01 - 14:28 | over 3 years |
| 2.6.12 | MIT | 1 | 2020-08-20 - 13:11 | about 4 years |
| 2.6.11 | MIT | 1 | 2019-12-13 - 19:58 | almost 5 years |
| 2.6.10 | MIT | 1 | 2019-03-20 - 06:27 | over 5 years |
| 2.6.9 | MIT | 1 | 2019-03-14 - 09:02 | over 5 years |
| 2.6.8 | MIT | 1 | 2019-03-01 - 15:03 | over 5 years |
| 2.6.7 | MIT | 1 | 2019-02-21 - 22:06 | over 5 years |
| 2.6.6 | MIT | 1 | 2019-02-12 - 04:20 | over 5 years |
| 2.6.5 | MIT | 1 | 2019-02-11 - 05:14 | over 5 years |
| 2.6.4 | MIT | 1 | 2019-02-08 - 21:45 | over 5 years |
| 2.6.3 | MIT | 1 | 2019-02-06 - 21:52 | over 5 years |
| 2.6.2 | MIT | 1 | 2019-02-05 - 03:52 | over 5 years |
| 2.6.1 | MIT | 1 | 2019-02-04 - 22:51 | over 5 years |
| 2.6.0 | MIT | 1 | 2019-02-04 - 15:57 | over 5 years |
| 2.6.0-beta.3 | MIT | 1 | 2019-01-30 - 14:59 | almost 6 years |
| 2.6.0-beta.2 | MIT | 1 | 2019-01-26 - 04:38 | almost 6 years |
| 2.6.0-beta.1 | MIT | 1 | 2019-01-16 - 16:21 | almost 6 years |
| 2.5.22 | MIT | 1 | 2019-01-11 - 23:18 | almost 6 years |
| 2.5.21 | MIT | 1 | 2018-12-11 - 22:52 | almost 6 years |
| 2.5.20 | MIT | 1 | 2018-12-10 - 16:57 | almost 6 years |
| 2.5.19 | MIT | 1 | 2018-12-09 - 21:26 | almost 6 years |
| 2.5.18 | MIT | 1 | 2018-12-07 - 21:09 | almost 6 years |
| 2.5.18-beta.0 | MIT | 1 | 2018-12-02 - 21:14 | almost 6 years |