Project

General

Profile

Actions
Copy link

SecOps #631

open
CD

[Sécurité] Vulnérabilité de code : src/lib/cache.ts:86 (javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp)

SecOps #631: [Sécurité] Vulnérabilité de code : src/lib/cache.ts:86 (javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp)

Added by Client Dashboard about 2 months ago. Updated about 2 months ago.

Status:
Submitted
Priority:
Normal
Assignee:
-
Start date:
06/15/2026
Due date:
% Done:

0%

Estimated time:
spec_ref:
build_status:
build_number:
ci_run_url:
scan_status:
scan_report_url:
deploy_status:
preprod_url:
deployed_at:
branch:
pr_url:
security_key:
src/lib/cache.ts:86_javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
severity:
medium
paused:

Description

**Sévérité** : MEDIUM
**Source** : Semgrep
`vuln-medium`
**Emplacement** : src/lib/cache.ts:86
**Règle** : javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp

RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.

### Extrait de code
```
requires login
```

### Lien CVE
https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

Actions
Copy link

Also available in: PDF Atom