The regex inside lib/pattern.js file seems to be vulnerable to Regex denial of service. I used this payload to cause a 17 second delay when a URL is processed by the parse() function. Maybe it can be even longer, probably depends on the length.
'//:' + '\t:\t'.repeat(90000)+ '\t'
The regex inside lib/pattern.js file seems to be vulnerable to Regex denial of service. I used this payload to cause a 17 second delay when a URL is processed by the parse() function. Maybe it can be even longer, probably depends on the length.
'//:' + '\t:\t'.repeat(90000)+ '\t'