CVE-2022-25940 HIGH

CVE-2022-25940: Denial of Service (DoS)

Vendor N/A
Product lite-server
Published December 21, 2022
Last update April 16, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

What the vulnerability does

01Description

All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.

Key dates

02Disclosure timeline

December 21, 2022 CVE published
April 16, 2025 Record updated