CVE-2023-26115
Is CVE-2023-26115 real, exploitable, or a false positive? Here's the community verdict.
Community verdict: No field verdicts yet. Be the first practitioner to weigh in.
signals
public sources
Moderate signals. Triage by your actual exposure and reachability.
cisa ssvc
CISA Vulnrichment · assessed
CISA decision, by how critical the affected system is to you:
- low impact → Track
- medium impact → Track
- high impact → Attend
Track: normal patch cycle · Track*: watch closely · Attend: patch sooner · Act: patch now. About SSVC ↗
affected packages
GHSA-j8xg-fqg3-53r7 · GitHub rates it moderate- npmword-wrap
- Vulnerable
- < 1.2.4
- Fixed in
- 1.2.4
Source: GitHub Advisory Database (CC-BY 4.0), via OSV.dev. Check your lockfile version against the ranges above.
baseline read
auto · not a community verdict
Low signal — verdict needed
Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.
Based on CVSS · FIRST EPSS
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2023-26115)<a href="https://www.truepositive.app/cve/CVE-2023-26115"><img src="https://www.truepositive.app/cve/CVE-2023-26115/badge.svg" alt="TruePositive verdict for CVE-2023-26115"></a>Live badge that updates automatically as the community verdict changes.
timeline
- CISA SSVC assessment · exploitation: poc
- Published by NVD
Score and exploit changes tracked since .
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: TruePositive's read from public sources is False positive / noise — a starting point, not a community verdict.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
This is a regular-expression denial-of-service in the word-wrap formatting utility. To exploit it, an attacker would need to control the string being wrapped, but word-wrap is used for formatting command-line output, logs, and help text, not for untrusted network input, so the malicious payload essentially never reaches it. It became the poster child for npm audit fatigue, with thousands of teams opening tickets for a transitive development dependency that has no realistic impact.
How to check: consider whether any attacker-controlled string is ever passed through word-wrap. It usually is not.
Commonly flagged by: npm audit, Snyk, Dependabot, OSV-Scanner.
- 0
The other side: in the unusual case where you do pass untrusted, attacker-sized input straight into word-wrap, a slow regex could cause a denial of service, so it is not literally impossible. For normal usage, though, the real-world risk is negligible.
- 0
Bump word-wrap to 1.2.4 or later to clear the audit noise, which is usually a one-line lockfile change. Do not treat it as an incident or let it block a release.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-1333.
- CVE-2026-45409MED 5.3EPSS 0%
Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
- CVE-2026-41848LOW 3.7EPSS 0%
Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path). Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.