Regular expression denial-of-service (ReDoS)- Vulnerability trim-newlines

[aadi1999]

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

https://nvd.nist.gov/vuln/detail/CVE-2021-33623

Please update the meow package version as 10.0.0(latest)

[emiwidknowit]

Any updates?

[TannerS]

Glad a PR for this got created! hopefully it will be merged soon!

[scottbarrow]

Any updates on this, there's a CVE resolution depending on it
GHSA-7p7h-4mm5-852v

Thanks

[TannerS]

I am also curious on this. It appears a lot of people are waiting on this and curious to why the PR is not merged yet

[toms-place]

Can we also get a new release for ^4.14.X?
Node Sass Middleware requires it..
https://www.npmjs.com/package/node-sass-middleware

[xzyfer]

Looks like we can back port this to 4.x by updating to meow@7 without too much happy. I'll try to cut a release in the next 48hrs.

[cronon]

Hi @xzyfer!
Did you have a chance to backport it to 4.x?