GHSA-h6ch-v84p-w6p9
HIGHGitHub ratingA vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
npm package report
Is diff safe?
2 known vulnerabilities, worst severity HIGH.
// reach
0 direct dependencies
none carry a known advisory
164 packages depend on it
an advisory here reaches each of them
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss
7.5
high
severity band, no base score published
epss
not scored
chance of exploitation in 30 days
xyz score
4.8
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-h6ch-v84p-w6p9, the advisory selected below
// 2 advisories
Checked 2026-11-06 at 23:10 UTC. The most recent advisory here was published 2026-01-14. Updated continuously from NVD, GHSA, OSV and CNA feeds.