GHSA-jc97-h3h9-7xh6 CVE-2023-26103

Regular Expression Denial of Service in Deno.upgradeWebSocket API

High crates.io

Severity: 5.3 / 10; High · CVSS 3.1
Exploit chance (EPSS): 1.23%; Chance of exploitation in the next 30 days. Higher than 68.92% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1333 Inefficient Regular Expression Complexity
Fix: 1.31.0; Upgrade deno to this version or later

Description

Impact

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.

Patches

It is recommended that users upgrade to Deno 1.31.0.

Affected versions

crates.io

Package	Vulnerable	Fixed in
deno	`>= 1.12.0, < 1.31.0`	`1.31.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

deno crates.io → `1.31.0`

cargo

cargo update -p deno --precise 1.31.0

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Weakness

CWE-1333: Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

How to prevent it

Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Implementation: Limit the length of the input that the regular expression will process.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2023-26103

Packages

github.com/denoland/deno

Timeline

Feb 25, 2023 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-x2qc-cmh9-f4hf Deno: Denial of service via non-ASCII bytes in WebSocket response headers	Medium	Also affects deno
GHSA-8xpq-cjcf-3wh9 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)	High	Also affects deno
GHSA-968w-xfqw-vp9q Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions	Medium	Also affects deno
GHSA-v8fw-85r8-5m23 Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks	Medium	Also affects deno
GHSA-9xg4-qhm4-g43w Deno: Miller-Rabin Primality Test Allows Zero Rounds	High	Also affects deno
GHSA-7xh3-mhg9-jcw8 Deno: Command Injection via spawnSync & spawn on Windows	High	Also affects deno
GHSA-4c8g-jvcx-v4hv Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access	Medium	Also affects deno
GHSA-83pc-3rw9-qpwj Deno: WebSocket API sandbox bypass via missing post-DNS check	Medium	Also affects deno

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor