CVE-2024-41655

HIGH

NPM Tf2-item-format < 5.9.14 - Denial of Service

Title source: rule
STIX 2.1

Description

TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.

Scores

CVSS v3 7.5
EPSS 0.0011
EPSS Percentile 29.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-1333 CWE-624
Status published
Products (2)
danocmx/node-tf2-item-format >= 4.2.6, < 5.9.14
npm/tf2-item-format 4.2.6 - 5.9.14npm
Published Jul 23, 2024
Tracked Since Feb 18, 2026