[GHSA-px4h-xg32-q955] ReDoS in normalize-url

[Wenxin-Jiang]

Updates

• Affected products

Comments
Versions 4.3.0 and 4.4.0 do not contain the vulnerable regular expression and should be classified as not affected. The correct introduced version is 4.4.1.

Version 4.3.0 contains no normalizeDataURL function and no data: URL handling at all; the source has zero occurrences of "data". Version 4.4.0 introduces normalizeDataURL, but the implementation uses ^data:(.*?),(.*)$, which consists of a single lazy group followed by a greedy trailing .* and does not include the optional hash fragment group. That regex shape does not exhibit the catastrophic backtracking behavior described in the advisory.

The vulnerable pattern first appears in 4.4.1, which ships ^data:(.*?),(.*?)(?:#(.*))?$. That is the exact regex later fixed in 4.5.1 by commit b1fdb51, which replaces the broad wildcard groups with constrained character classes ([^,]*? / [^#]*?).

Runtime PoC ReDoS testing matches the source analysis: exploitation fails on 4.3.0 and 4.4.0, and succeeds on 4.4.1 and later affected versions.

Accordingly, the introduced version should be 4.4.1, and the affected range should be narrowed from >= 4.3.0, < 4.5.1 to >= 4.4.1, < 4.5.1.