GHSA-c2hf-g6w4-jrj6: 
JavaScript vulnerability analysis and mitigation

Impact

The parser looks for issue references in every line of a commit message, and the regular expression it used for that backtracked in cubic time on a line without references. A line of 4000 spaces or letters took over a minute to parse, and longer lines hang the process. Any tool that parses commit messages it doesn't control is affected: changelog and release tooling on a repository that merges outside contributions, commit linting of pull requests, and services that parse user-supplied commit messages.

Patches

Fixed in 7.1.4, where lines are scanned for references in linear time: a line of 100,000 characters parses in 16–32 ms.

Workarounds

Truncate long lines of commit messages before parsing them.

References

• #1571
• #1574