@mozilla/readability Denial of Service through Regex

published 2025-03-26 last yr. modified 2025-03-26 last yr. also GHSA-3p6v-hrg8-8qj7

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.

Additional Details are [available at Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1948833)

Credit: DayShift

Patch / fix

fixed in 1 links 1

npm @mozilla/readability 0.6.0

github.com/mozilla/readability@1c4d63b commit

Is CVE-2025-2792 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	@mozilla/readability	<0.6.0	0.6.0

Classification

Weakness

CWE-1333 Inefficient Regular Expression Complexity

References

Sources

GitHub Advisory GHSA-3p6v-hrg8-8qj7

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.