What’s Vulnerable › Vulnerabilities

CVE-2022-1929: Exponential ReDoS in devcert

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-02 · updated 2026-06-17
• Weakness: CWE-1333

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

Affected products

• devcert: before 1.2.1 — fixed in 1.2.1

How to fix

Upgrade to a fixed version: devcert 1.2.1. Check the vendor advisory for mitigations.

References

• https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352/
• https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352/

Get alerted when CVE-2022-1929 or the next vulnerability affects your stack