Is CVE-2023-26115 exploitable?

The community verdict is "False positive / noise", based on 3 practitioner verdicts.

Is CVE-2023-26115 a false positive?

2 of 3 practitioner verdicts marked CVE-2023-26115 a false positive or could not reproduce it.

How do I remediate CVE-2023-26115?

Practitioners have shared remediation steps for CVE-2023-26115 — see the remediation notes on this page.

CVE-2023-26115

is CVE-2023-26115real, exploitable, or a false positive? Here's the community ground truth.

☆ Watch

Medium · CVSS 5.3EPSS 1.7%CWE-1333

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

References

NVD MITRE CVE.org

Published Jun 22, 2023

Embed this verdict

Markdown

[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2023-26115/badge.svg)](https://www.truepositive.app/cve/CVE-2023-26115)

HTML

<a href="https://www.truepositive.app/cve/CVE-2023-26115"><img src="https://www.truepositive.app/cve/CVE-2023-26115/badge.svg" alt="TruePositive verdict for CVE-2023-26115"></a>

Live badge — updates automatically as the community verdict changes.

Community ground truth

Community verdict

3 verdicts

Not a real issue

Includes TruePositive's curated baseline from public sources — community verdicts accrue on top.

to add your verdict.

Community real-world severity: Low (Low 1) — CVSS base score 5.3

Practitioners rate this lower than its CVSS — likely over-rated by the score.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

0
Field note · Nadia PetrovaCurated
Regex denial-of-service in the word-wrap formatting utility. To exploit it an attacker must control the string being wrapped — but word-wrap is used for CLI/log/help-text formatting, not on untrusted network input, so the malicious payload essentially never reaches it. It became the poster child for npm audit fatigue: thousands of teams opened tickets for a transitive dev-dependency finding with no realistic impact.

Sources: GitHub advisory GHSA-j8xg-fqg3-53r7 · NVD.
0
Remediation · Waleed AzizCurated
Bump word-wrap to 1.2.4+ to clear the audit noise (a one-line lockfile change). Don't treat it as an incident — for typical usage the real-world risk is negligible.