CVE-2021-3749: Redos Whitespace Replace Star Quantifier

ReDoS (Regular Expression Denial of Service): Using /^\s*/ or /\s*$/ in String.replace() can cause catastrophic backtracking when processing strings with many whitespace characters followed by a non-whitespace character (CVE-2021-3749). The \s* zero-or-more quantifier combined with start/end anchors forces the regex engine into O(N^2) backtracking on adversa

Provally CuratedPublic repositoryMediumHigh confidenceVerifiedApache-2.0javascript
greprules fetch cve-2021-3749-redos-whitespace-replace-star-quantifier --engine opengrep

Description

ReDoS (Regular Expression Denial of Service): Using /^\s*/ or /\s*$/ in String.replace() can cause catastrophic backtracking when processing strings with many whitespace characters followed by a non-whitespace character (CVE-2021-3749). The \s* zero-or-more quantifier combined with start/end anchors forces the regex engine into O(N^2) backtracking on adversa

Detection target

Not provided

Recommended fix

Not provided

False-positive notes

Not provided

Community feedback

Sign in to report false positives, mark this rule useful, or suggest metadata improvements.