Severity: moderate

Regular Expression Denial of Service



All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function.


The bleach package is not currently maintained, and has not seen an update since 2014.

To mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality. There are multiple modules fitting this criteria available on npm..

Have content suggestions? Send them to [email protected]

Advisory timeline

  1. published

    Advisory published
    Oct 24th, 2015
  2. reported

    Initial report by Adam Baldwin
    Oct 24th, 2015