LiveActive security incident?Get immediate response
CVE Record

CVE-2021-33623: The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular exp...

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-33623 is a denial-of-service issue in the Node.js trim-newlines package. Affected versions can spend excessive CPU time processing certain input through the .end() method, potentially slowing or stalling an application that uses it.

Executive priority

Treat this as a dependency hygiene and availability risk. It is not documented here as actively exploited, but vulnerable packages should be updated during normal patch cycles, faster for internet-facing services processing user-supplied text.

Technical view

The CVE describes a regular expression denial-of-service issue in trim-newlines before 3.0.1 and 4.x before 4.0.1, specifically in the .end() method. The source bundle does not provide CVSS, CWE, detailed exploit conditions, or affected downstream products.

Likely exposure

Exposure is most likely in Node.js applications or build tooling that include vulnerable trim-newlines versions directly or transitively, especially where untrusted text reaches .end(). Downstream product impact is not fully enumerated in the provided sources.

Exploitation context

The source bundle does not show CISA KEV listing or cite active exploitation. Public references identify the vulnerability and security updates, but do not provide confirmed exploitation evidence in the supplied material.

Researcher notes

Evidence is limited to package and advisory references. The CVE identifies the vulnerable method and fixed version boundaries, but omits CVSS, CWE, affected CPEs, and exploit prerequisites. Validate exposure through software composition analysis and runtime call-path review.

Mitigation direction

  • Upgrade trim-newlines to 3.0.1 or later on the 3.x line.
  • Upgrade trim-newlines 4.x deployments to 4.0.1 or later.
  • Update Debian node-trim-newlines packages where managed by Debian security repositories.
  • Check vendor advisories for bundled or appliance-specific guidance.
  • Rebuild and redeploy applications after dependency updates.

Validation and detection

  • Search dependency lockfiles for trim-newlines versions below fixed releases.
  • Check transitive dependency trees, not only direct package.json entries.
  • Confirm production artifacts contain the fixed package version.
  • Review code paths where untrusted text reaches trim-newlines .end().
  • Verify Debian package versions against DLA-3247-1 where applicable.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-33623 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.