CVE-2024-41655
High
Description
TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.
SeverityHigh
CVSS7.5
Exploit probability—
ProductTf2-item-format
PublishedJul 23, 2024
First seenJul 23, 2024
Weakness typeCWE-624CWE-624CWE-1333CWE-1333
How to fix
Update
- tf2-item-format5.9.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tf2-item-formatnpm | 4.2.6 ≤ v < 5.9.14 | 5.9.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.