Catastrophic backtracking in duration parsing

The duration grammar backtracks super-linearly on a long run of digits. A single request carrying an attacker-supplied timeout string can hold an event loop for seconds.

SyntheticThis advisory is invented for the demonstration. ms is a real package; nothing described here has been reported against it.