The jsdiff JavaScript library (versions before 3.5.1) has an uncontrolled resource consumption vulnerability (CWE-400) in its parsePatch method. When parsing patches whose filename headers contain the characters \r, \u2028, or \u2029, parsePatch can enter an infinite loop, consuming memory until the process crashes. This can lead to denial-of-service if user input is parsed without validation. The applyPatch method is also affected when called with a string patch argument, as it internally calls parsePatch. Additionally, a related Regular Expression Denial of Service (ReDOS) vulnerability (CWE-1333) causes parsePatch to take O(n³) time when malicious patch headers contain these characters. Fixed in versions 3.5.1, 4.0.4, 5.2.2, and 8.0.3. The Red Hat advisory confirms these details but does not provide additional remediation beyond the fixed versions.

Exploitation of this vulnerability can cause applications using vulnerable jsdiff versions to consume excessive memory or CPU resources, leading to denial-of-service conditions. This can occur even with small inputs containing specific line break characters in patch filename headers. The vulnerability affects any application calling parsePatch or applyPatch with user-controlled patch strings containing these characters.

Fixed versions 3.5.1, 4.0.4, 5.2.2, and 8.0.3 of jsdiff are available and should be applied to remediate this vulnerability. As a workaround, avoid parsing patches containing the characters \r, \u2028, or \u2029 in filename headers. No other methods in the library are affected. Review application logic to ensure user input is validated before calling parsePatch or applyPatch.