- ApplicationAuth Gateway
- Hop 1declared · ^7.1.0rollup7.1.0
USY-2026-0112 · Regular expression denial of service · score 3.7
An unterminated ANSI escape followed by a long payload backtracks quadratically. Low impact in isolation; notable because of how far the package reaches.
SyntheticThis advisory is invented for the demonstration. ansi-regex is a real package; nothing described here has been reported against it.
Drop the application at one end and the flawed release at the other, and count what is left in the middle. xml2js sits on 3 of the 9 shortest paths, which makes it the cheapest single place to break the chain.
Docs Site · Inventory Sync · Mobile BFF
Admin Console · Ledger API
Checkout Service · Notification Relay
Checkout Service · Notification Relay
Inventory Sync
One account can publish this package. Whoever holds it can reach everything downstream of it, with or without an advisory.
Admin Console
Storefront Web
Notification Relay
Mobile BFF
Inventory Sync
Storefront Web
Checkout Service