Regular Expression Denial of Service in Handlebars

GHSA-62gr-4qp9-h98f · CVE-2019-20922

Published Feb 10, 2022 · Modified Mar 13, 2026

Description

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-20922
WEB https://github.com/handlebars-lang/handlebars.js/commit/8d5530ee2c3ea9f0aee3fde310b9f36887d00b8b
WEB https://snyk.io/vuln/SNYK-JS-HANDLEBARS-480388
WEB https://www.npmjs.com/advisories/1300
WEB https://www.npmjs.com/package/handlebars

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes