CVE-2021-23371

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	chrono-node	>= unspecified, < 2.2.4

References

https://github.com/wanasit/chrono/commit/98815b57622443b5c498a427210ebd603d705f4cPatch, Third Party Advisory
https://github.com/wanasit/chrono/issues/382Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-CHRONONODE-1083228Exploit, Third Party Advisory
https://github.com/wanasit/chrono/commit/98815b57622443b5c498a427210ebd603d705f4cPatch, Third Party Advisory
https://github.com/wanasit/chrono/issues/382Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-CHRONONODE-1083228Exploit, Third Party Advisory

Timeline

Published: Apr 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-233727.5All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandl CVE-2021-233739.8All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.CVE-2021-233749.8This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an atta CVE-2021-233759.8This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker CVE-2021-233769.8This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for a CVE-2021-233779.8This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an CVE-2021-233789.8This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker CVE-2021-233799.8This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arb CVE-2021-23386.1Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing Stand-Alone). Supported versions that CVE-2021-233807.3This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certa CVE-2021-233819.8This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrar CVE-2021-233827.5The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation()