CVE-2024-41655: TF2 Item Format Regular Expression Denial of Service vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-23 · updated 2026-06-17
Weakness: CWE-624

Description

TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.

Affected products

danocmx node-tf2-item-format: from 4.2.6 before 5.9.14 — fixed in 5.9.14

How to fix

Upgrade to a fixed version: danocmx node-tf2-item-format 5.9.14. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-41655 or the next vulnerability affects your stack