UpHeron
All vulnerabilities

Servers and applications

CVE-2023-26103

Regular Expression Denial of Service in Deno.upgradeWebSocket API

Severity
High 7.5
Published
25 Feb 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.31.0
Also known as
GHSA-jc97-h3h9-7xh6
Sources
NVD, Project advisories (GitHub)

Description

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.

Affected software

SoftwareAffected versions
DenoServers and applications · cpe:a:deno:deno
  • Every version before 1.31.0
DenoServers and applications · github:denoland/deno
  • Version 1.12.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-26103
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-26103
  • GitHub Advisory Database https://github.com/advisories/GHSA-jc97-h3h9-7xh6
  • github.com https://github.com/denoland/deno/security/advisories/GHSA-jc97-h3h9-7xh6