CVE-2022-25940

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	lite-server	< unspecified

References

https://gist.github.com/lirantal/832382155e00da92bfd8bb3adea474ebExploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3175617Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-LITESERVER-3153540Exploit, Third Party Advisory
https://gist.github.com/lirantal/832382155e00da92bfd8bb3adea474ebExploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3175617Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-LITESERVER-3153540Exploit, Third Party Advisory

Timeline

Published: Dec 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-259427.8An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead t CVE-2022-259437.8The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the serv CVE-2022-259466.5On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configur CVE-2022-259485.3The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in l CVE-2022-259497.8The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading CVE-2022-259510.0Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.CVE-2022-259528.8Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress.CVE-2022-259597.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an CVE-2022-25965.9Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.CVE-2022-259629.8All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.CVE-2022-259667.8Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potent CVE-2022-259678.8Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variable