CVE-2020-26305: 
JavaScript vulnerability analysis and mitigation

CommonRegexJS, a JavaScript port of CommonRegex, contains a vulnerability identified as CVE-2020-26305. All available versions of the library contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability was discovered and reported by GitHub Security Lab team member Erik Krogh Kristensen, and as of the time of publication, no known patches were available (GitHub Advisory).

The vulnerability specifically affects the links regex functionality within CommonRegexJS. When processing certain input patterns, the regular expression can trigger exponential backtracking, leading to excessive CPU usage. The vulnerability was identified using a CodeQL query that detected potentially problematic regex patterns (GitHub Advisory). The vulnerability has been assigned a CVSS 3.1 Base Score of 7.5 HIGH with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

This vulnerability may lead to a denial of service condition. When exploited, the affected regular expressions can cause the application to consume excessive CPU resources, potentially making the service unresponsive (GitHub Advisory).

At the time of the vulnerability disclosure, no known patches were available for this issue (NVD).