github_osv/GHSA-xfhp-gmh8-r8v2
printf vulnerable to Regular Expression Denial of Service (ReDoS)
The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string
```regex
/\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g
```
in `lib/printf.js`. The vulnerable regular expression has cubic worst-case time complexity.
gitlab/npm/printf/CVE-2021-23354
Uncontrolled Resource Consumption
The package printf is vulnerable to Regular Expression Denial of Service.