Medium severity5.3NVD Advisory· Published Mar 12, 2021· Updated Jun 17, 2026
CVE-2021-23354
CVE-2021-23354
Description
The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
printfnpm | < 0.6.1 | 0.6.1 |
Affected products
3- printf/printfdescription
Patches
Vulnerability mechanics
References
6- github.com/adaltas/node-printf/pull/32nvdPatchThird Party AdvisoryWEB
- github.com/adaltas/node-printf/issues/31nvdExploitIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-xfhp-gmh8-r8v2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-23354ghsaADVISORY
- github.com/adaltas/node-printf/commit/a8502e7c9b0b22555696a2d8ef67722086413a68ghsaWEB
- snyk.io/vuln/SNYK-JS-PRINTF-1072096nvdBroken LinkWEB
News mentions
0No linked articles in our index yet.