CVE-2022-25940

All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.

Score

CVSS 3.1 7.5 High

Status

Modified - report@snyk.io

Published

2022-12-20

Last modified

2025-04-16

Weaknesses

CWE-20

Affected products

• Lite-server (Lite-server Project)

References

• https://gist.github.com/lirantal/832382155e00da92bfd8bb3adea474eb
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3175617
• https://security.snyk.io/vuln/SNYK-JS-LITESERVER-3153540