USY-2026-0121 · Regular expression denial of service · score 3.1

Backtracking in namespace matching — no fixed release

Namespace wildcards compile to a pattern that backtracks on long, highly repetitive namespace strings. No fixed release has been published; the maintainers consider the input trusted.

SyntheticThis advisory is invented for the demonstration. debug is a real package; nothing described here has been reported against it.

Affected package

debug

Affected releases

2 from 4.0.0

Fixed in

No fixed release

Published

30 Apr 2026

Blast radius

9 of 12 · nearest 2

Admin ConsoleInternal Tools2 hops · 2 affected releases

Application
Admin Console
Hop 1declared · ^6.7.0
mapbox-gl6.7.0
Faulttransitive · >=4.0.0 <5.0.0
debug4.0.2
Affected. No fixed release has been published.

Ledger APIPayments2 hops · 3 affected releases

Not reached · 3Data Exporter, Fraud Scoring, Reporting Pipeline

Where to cut

dayjs carries 2 of 9

Drop the application at one end and the flawed release at the other, and count what is left in the middle. dayjs sits on 2 of the 9 shortest paths, which makes it the cheapest single place to break the chain.

dayjs 4.3.16on 2 of 9 paths

Ledger API · Mobile BFF

pino 3.2.5on 2 of 9 paths

Checkout Service · Inventory Sync

bullmq 5.0.0on 1 of 9 paths

Docs Site

framer-motion 5.0.0on 1 of 9 paths

Mobile BFF

http-proxy-middleware 2.10.9on 1 of 9 paths

Docs Site

ioredis 2.0.2