Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4kjh-zmaz-tqb7
Vulnerability ID VCID-4kjh-zmaz-tqb7
Aliases CVE-2021-23362
GHSA-43f8-2h32-f4cj
Summary Regular Expression Denial of Service in hosted-git-info The npm package `hosted-git-info` before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-400 Uncontrolled Resource Consumption
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-23362.json
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
epss 0.00554 https://api.first.org/data/v1/epss?cve=CVE-2021-23362
cvssv3.1 5.3 https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
generic_textual MODERATE https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-43f8-2h32-f4cj
cvssv3.1 5.3 https://github.com/npm/hosted-git-info
generic_textual MODERATE https://github.com/npm/hosted-git-info
cvssv3.1 5.3 https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
generic_textual MODERATE https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
cvssv3.1 5.3 https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01
generic_textual MODERATE https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01
cvssv3.1 5.3 https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
generic_textual MODERATE https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
cvssv3.1 5.3 https://github.com/npm/hosted-git-info/commits/v2
generic_textual MODERATE https://github.com/npm/hosted-git-info/commits/v2
cvssv3.1 5.3 https://github.com/npm/hosted-git-info/pull/76
generic_textual MODERATE https://github.com/npm/hosted-git-info/pull/76
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2021-23362
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-23362
archlinux High https://security.archlinux.org/AVG-2126
cvssv3.1 5.3 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
generic_textual MODERATE https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
cvssv3.1 5.3 https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
generic_textual MODERATE https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-23362.json
https://api.first.org/data/v1/epss?cve=CVE-2021-23362
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23362
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/npm/hosted-git-info
https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01
https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
https://github.com/npm/hosted-git-info/commits/v2
https://github.com/npm/hosted-git-info/pull/76
https://nvd.nist.gov/vuln/detail/CVE-2021-23362
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
1943208 https://bugzilla.redhat.com/show_bug.cgi?id=1943208
ASA-202107-13 https://security.archlinux.org/ASA-202107-13
AVG-2126 https://security.archlinux.org/AVG-2126
GHSA-43f8-2h32-f4cj https://github.com/advisories/GHSA-43f8-2h32-f4cj
RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438
RHSA-2021:2931 https://access.redhat.com/errata/RHSA-2021:2931
RHSA-2021:2932 https://access.redhat.com/errata/RHSA-2021:2932
RHSA-2021:3073 https://access.redhat.com/errata/RHSA-2021:3073
RHSA-2021:3074 https://access.redhat.com/errata/RHSA-2021:3074
RHSA-2021:3638 https://access.redhat.com/errata/RHSA-2021:3638
RHSA-2021:3639 https://access.redhat.com/errata/RHSA-2021:3639
USN-USN-5216-1 https://usn.ubuntu.com/USN-5216-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-23362.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/npm/hosted-git-info
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/npm/hosted-git-info/commits/v2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/npm/hosted-git-info/pull/76
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2021-23362
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.68011
EPSS Score 0.00554
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:03:00.809046+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-43f8-2h32-f4cj/GHSA-43f8-2h32-f4cj.json 38.0.0