High severity · published Sep 30, 2020
CVE-2019-20922
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching
7.5
CVSS
3.7%
EPSS
No
On KEV
Description
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Handlebars · Handlebarsjs
4.0.0 before 4.4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-20922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-20922
Patch
https://github.com/handlebars-lang/handlebars.js/commit/8d5530ee2c3ea9f0aee3fde310b9f36887d00b8b
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-480388
Third Party Advisory
https://www.npmjs.com/advisories/1300
More from Handlebars
9.8
CVE-2026-33937
Handlebars.js has JavaScript Injection via AST Type Confusion
9.8
CVE-2021-23383
Prototype Pollution
9.8
CVE-2021-23369
Remote Code Execution (RCE)
8.2
CVE-2026-33941
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
8.1
CVE-2026-33940
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial