tarteaucitron.js Regular Expression Denial-of-Service Vulnerability

A Regular Expression Denial-of-Service (ReDoS) vulnerability exists in tarteaucitron.js versions prior to 1.29.0. The issue arises in the processing of the 'issuu_id' parameter, where insufficiently constrained regular expressions can be exploited to cause excessive backtracking. This exploitation leads to high CPU usage and potential service disruption.

Impact

Exploitation of this vulnerability can cause significant CPU exhaustion, degrading performance and temporarily disrupting service availability.

Remediation

Users can upgrade to tarteaucitron.js version 1.29.0 or later to address this vulnerability.