Regular Expression Denial of Service (ReDoS) vulnerability

[MateuszKikmunter]

Basic info:

• Node.js version: 16.15.1
• jsdom version: 21.1.0

Snyk reports that jsdom is vulnerable to Regular Expression Denial of Service (ReDoS)

Minimal reproduction case

Run snyk scan against the package.

[MateuszKikmunter]

Closing as there's a PR with a fix pending in the word-wrap repo.

[jacobleesinger]

It doesn't look like that PR's ever going to get merged 😞

[nchevsky]

For anyone else depending on jsdom <= 21, it's possible to upgrade escodegen to v2.1.0 which moves optionator from dependencies to devDependencies, removing word-wrap from the equation altogether.

Before

└─┬ jest-environment-jsdom@29.6.0
  └─┬ jsdom@20.0.1
    └─┬ escodegen@2.0.0
      └─┬ optionator@0.8.3
        └── word-wrap@1.2.3

After

└─┬ jest-environment-jsdom@29.6.0
  └─┬ jsdom@20.0.1
    └── escodegen@2.1.0