CVE-2023-26115: 
JavaScript vulnerability analysis and mitigation

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable. The vulnerability was disclosed on November 28, 2022, and published on March 22, 2023, affecting all versions before 1.2.4 (Snyk Advisory).

The vulnerability stems from an insecure regular expression implementation within the result variable. While the regex is vulnerable on its own, the vulnerable function is not directly reachable as shipped in the package. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NVD and 5.3 (MEDIUM) by Snyk, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

When exploited, this vulnerability can lead to a Denial of Service condition through excessive CPU consumption. The attack can cause the service to work very slowly, with performance degradation exponentially related to input size. While repeated exploitation is possible, the attacker does not have the ability to completely deny service to legitimate users (Snyk Advisory).

The recommended mitigation is to upgrade the word-wrap package to version 1.2.4 or higher, which contains the fix for this vulnerability (GitHub Release).