What’s Vulnerable › Vulnerabilities

CVE-2021-43309: ReDoS in uri-template-lite URI.expand function

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-24 · updated 2026-06-17
• Weakness: CWE-1333

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method

Affected products

• uri-template-lite: all versions

References

• https://github.com/litejs/uri-template-lite/compare/v22.1.0...v22.9.0
• https://research.jfrog.com/vulnerabilities/uri-template-lite-redos-xray-211351/
• https://github.com/litejs/uri-template-lite/compare/v22.1.0...v22.9.0
• https://research.jfrog.com/vulnerabilities/uri-template-lite-redos-xray-211351/

Get alerted when CVE-2021-43309 or the next vulnerability affects your stack