What’s Vulnerable › Vulnerabilities

CVE-2024-27088: es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-26 · updated 2026-06-17
• Weakness: CWE-400

Description

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.

Affected products

• medikoo es5-ext: from 0.10.0 before 0.10.63 — fixed in 0.10.63
• Npm Es5-Ext: from 0.10.0 before 0.10.63 — fixed in 0.10.63

How to fix

Upgrade to a fixed version: medikoo es5-ext 0.10.63; Npm Es5-Ext 0.10.63. Check the vendor advisory for mitigations.

References

• https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2
• https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602
• https://github.com/medikoo/es5-ext/issues/201
• https://github.com/medikoo/es5-ext/security/advisories/GHSA-4gmj-3p3h-gm8h
• https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2
• https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602
• https://github.com/medikoo/es5-ext/issues/201
• https://github.com/medikoo/es5-ext/security/advisories/GHSA-4gmj-3p3h-gm8h

Get alerted when CVE-2024-27088 or the next vulnerability affects your stack