CVE-2023-26115
Is CVE-2023-26115 real, exploitable, or a false positive? Here's the community verdict.
signals
public sources
Moderate signals. Triage by your actual exposure and reachability.
baseline read
auto · not a community verdict
Low signal — verdict needed
Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.
Based on CVSS · FIRST EPSS
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2023-26115)<a href="https://www.truepositive.app/cve/CVE-2023-26115"><img src="https://www.truepositive.app/cve/CVE-2023-26115/badge.svg" alt="TruePositive verdict for CVE-2023-26115"></a>Live badge that updates automatically as the community verdict changes.
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: TruePositive's read from public sources is False positive / noise — a starting point, not a community verdict.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
This is a regular-expression denial-of-service in the word-wrap formatting utility. To exploit it, an attacker would need to control the string being wrapped, but word-wrap is used for formatting command-line output, logs, and help text, not for untrusted network input, so the malicious payload essentially never reaches it. It became the poster child for npm audit fatigue, with thousands of teams opening tickets for a transitive development dependency that has no realistic impact.
How to check: consider whether any attacker-controlled string is ever passed through word-wrap. It usually is not.
Commonly flagged by: npm audit, Snyk, Dependabot, OSV-Scanner.
- 0
The other side: in the unusual case where you do pass untrusted, attacker-sized input straight into word-wrap, a slow regex could cause a denial of service, so it is not literally impossible. For normal usage, though, the real-world risk is negligible.
- 0
Bump word-wrap to 1.2.4 or later to clear the audit noise, which is usually a one-line lockfile change. Do not treat it as an incident or let it block a release.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-1333.
- CVE-2024-21490HIGH 7.5Real · low riskEPSS 2%
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).
- CVE-2022-42124HIGH 7.5Real · low riskEPSS 1%
ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype.
- CVE-2026-28356HIGH 7.5Real · low riskEPSS 1%
multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.
- CVE-2026-52746HIGH 7.5Real · low riskEPSS 1%
JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0.
- CVE-2025-69873LOW 2.9EPSS 0%
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.
- CVE-2026-45367HIGH 7.5Real · low riskEPSS 0%
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.