CVE-2023-23925: 
JavaScript vulnerability analysis and mitigation

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the switcher-client npm package, tracked as CVE-2023-23925. The vulnerability was discovered and disclosed on February 2, 2023, affecting versions below 3.1.3 of the package. The issue stems from unsanitized input in the Strategy match operation (EXIST) functionality (GitHub Advisory).

The vulnerability occurs when unsanitized input flows into the Strategy match operation (EXIST), where it is used to build a regular expression. This implementation can lead to a Regular Expression Denial of Service (ReDoS) attack. The vulnerability has been assigned a High severity rating, with an attack vector through the network and low attack complexity (NVD).

When exploited, this vulnerability can result in a Regular Expression Denial of Service (ReDoS) attack, potentially causing resource consumption issues and affecting system availability. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (GitHub Advisory).

The vulnerability has been patched in version 3.1.4 of the switcher-client package. As a workaround, users are advised to avoid using Strategy settings that use REGEX in conjunction with EXIST and NOT_EXIST operations. For those unable to upgrade immediately, this workaround can help mitigate the risk (GitHub Release).