redos
Safeguard articles tagged "redos" — guides, analysis, and best practices for software supply chain and application security.
53 articles
JavaScript Security Vulnerabilities: The Ones That Actually Bite
JavaScript security vulnerabilities cluster around a few patterns: XSS, prototype pollution, ReDoS, and dependency risk. Here is how each works and how to catch it.
PrismJS: Vulnerability History and Hardening Your Syntax Highlighting
The npm prismjs package has patched ReDoS, plugin XSS, and a DOM clobbering flaw over the years. Here is the full history and how to run a syntax highlighter safely.
fast-xml-parser on npm: Security Review and Safe Usage
fast-xml-parser is one of the most-downloaded XML parsers on npm. Here is its security history, the CVEs that mattered, and how to use it safely.
Regex DDoS (ReDoS): How Catastrophic Backtracking Takes Down a Service
A regex DDoS, or ReDoS, weaponizes a slow regular expression so a short input pins a CPU core for seconds or minutes. Here is why it happens and how to detect and fix it.
Validating URLs Safely in Python with the validators Library
The Python validators library's url validator is a quick way to check URLs, but older regex-based versions carried a ReDoS risk. Here's how to use it safely.
Regular Expression Denial of Service (ReDoS) explained
ReDoS turns a single crafted string into an exponential-time attack. Here's how catastrophic backtracking works, real CVEs, and how to detect it.
Regular expression DoS in the ms npm package
A ReDoS flaw in the ubiquitous npm package ms (CVE-2015-8315) still surfaces in dependency scans today. Here's the impact, fix, and remediation steps.
Ajv npm: A Security Review and Safe Usage Guide
The ajv npm package is the most widely used JSON Schema validator in the Node ecosystem. Here is what you need to know about its security history and safe configuration.
Is the npm xlsx Package Safe? A Security Review
A security review of the npm xlsx (SheetJS) package: its prototype pollution and ReDoS CVEs, the npm-versus-CDN patch gap, and how to install it safely.
node-html-parser: How to Parse HTML Safely in Node.js
node-html-parser is a fast, dependency-light HTML parser for Node.js. Here is how to use it without opening the door to injection or denial-of-service bugs.
papaparse npm: Security Review and Best Practices
PapaParse is the go-to CSV parser for JavaScript, but older versions carry a ReDoS flaw. Here is a security review and how to use it safely on untrusted files.
CVE-2022-25844: The AngularJS ReDoS Bug and How to Fix It
CVE-2022-25844 is a regular-expression denial-of-service flaw in AngularJS. Here is what it affects, why there is no upstream patch, and how to remediate it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.