VYPR
← All advisories
High severityNVD Advisory· Published Oct 27, 2020· Updated Sep 16, 2024

Regular Expression Denial of Service (ReDoS)

CVE-2020-7753

Description

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2020-7753 identifies a Regular Expression Denial of Service (ReDoS) vulnerability in the npm 'trim' package, affecting all versions via the trim() function.

Vulnerability

Overview CVE-2020-7753 is a Regular Expression Denial of Service (ReDoS) vulnerability discovered in the npm package trim. The flaw exists within the trim() function itself and affects all versions of the package [1]. The root cause is a vulnerable regular expression that can be exploited to cause catastrophic backtracking [2][3].

Exploitation

Conditions An attacker can trigger the ReDoS by providing a specially crafted string input to the trim() function. The attack requires no special privileges or authentication; any application that processes user-controlled strings through trim() is potentially vulnerable. The malicious input causes the regular expression engine to enter a state of exponential backtracking, consuming excessive CPU time [2][3].

Impact

Successful exploitation leads to a Denial of Service (DoS) condition, where the application becomes unresponsive or extremely slow due to CPU exhaustion. This can disrupt service availability for legitimate users [2][3]. The attack is a typical ReDoS pattern, similar to examples with nested quantifiers like /(B|C+)+D/ [3].

Mitigation

The trim package as of the advisory lacks a fix, making all versions affected [3]. Developers should replace the function with a safe alternative, such as JavaScript's native String.prototype.trim(), which is not susceptible to this ReDoS. The advisory notes that the package's own source code (available on GitHub) contains the vulnerable regex [4].

References
  1. NVD - CVE-2020-7753
  2. Snyk Vulnerability Database | Snyk
  3. Snyk Vulnerability Database | Snyk
  4. trim/index.js at master · component/trim

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
trimnpm
< 0.0.30.0.3

Affected products

93

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

17

News mentions

0

No linked articles in our index yet.