PT-2026-3905 · Jsdiff · Jsdiff

Guiyi-He · Published 2026-01-14 · Updated 2026-03-04 · CVE-2026-24001

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jsdiff versions prior to 8.0.3 jsdiff versions prior to 5.2.2 jsdiff versions prior to 4.0.4

Description jsdiff is a JavaScript text differencing implementation. When processing a patch file, if the filename headers contain specific line break characters (

r

,

u2028

, or

u2029

), the

parsePatch

method can enter an infinite loop, leading to excessive memory consumption and a potential denial-of-service (DoS) attack. The

applyPatch

method is also affected when called with a string representation of a patch, as it utilizes the

parsePatch

method internally. A ReDOS (Regular Expression Denial of Service) vulnerability also exists when these line break characters are present in the patch header, potentially causing the

parsePatch

method to take O(n³) time to parse a maliciously crafted header of length n. This issue does not require a large payload to trigger and size limits on user input do not provide protection. Applications that call

parsePatch

with user-provided patches are susceptible.

Recommendations jsdiff versions prior to 8.0.3: Upgrade to version 8.0.3 or later. jsdiff versions prior to 5.2.2: Upgrade to version 5.2.2 or later. jsdiff versions prior to 4.0.4: Upgrade to version 4.0.4 or later. As a temporary workaround, avoid parsing patches containing the characters

r

,

u2028

, or

u2029

.

Exploit

Fix

DoS

RCE

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

BDU:2026-01717

CVE-2026-24001

GHSA-73RR-HH4G-FPGX

Affected Products

Jsdiff

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24001.json · Exploit
• https://github.com/kpdecker/jsdiff/pull/649 · Patch
• https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5 · Patch
• https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-24001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24001 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-24001 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-24001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24001 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-73rr-hh4g-fpgx · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01717 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24001 · Vendor Advisory
• https://github.com/kpdecker/jsdiff/issues/653 · Note