CVE-2023-34109

zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using the second argument of the zxcvbn function. It can result in an unbounded resource consumption as the user inputs array is extended with every function call. Browsers are impacted, too but a single user need to do a lot of input changes so that it affects the browser, while the node process gets the inputs of every user of a platform and can be killed that way. This problem has been patched in version 3.0.2. Users are advised to upgrade. Users unable to upgrade should stop using the second argument of the zxcvbn function and use the zxcvbnOptions.setOptions function.

• CWE-400

• https://github.com/zxcvbn-ts/zxcvbn/commit/3f9bed21b5d01f6f6863476822ca857355fba22fPatch
• https://github.com/zxcvbn-ts/zxcvbn/security/advisories/GHSA-38hx-x5hq-5fg4Vendor Advisory
• https://github.com/zxcvbn-ts/zxcvbn/commit/3f9bed21b5d01f6f6863476822ca857355fba22fPatch
• https://github.com/zxcvbn-ts/zxcvbn/security/advisories/GHSA-38hx-x5hq-5fg4Vendor Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34103Avo is an open source ruby on rails admin panel creation fra…5.4
• CVE-2023-34104fast-xml-parser is an open source, pure javascript xml parse…7.5
• CVE-2023-34105SRS is a real-time video server supporting RTMP, WebRTC, HLS…7.5
• CVE-2023-34106GLPI is a free asset and IT management software package. Ver…6.5
• CVE-2023-34107GLPI is a free asset and IT management software package. Ver…6.5
• CVE-2023-34108mailcow is a mail server suite based on Dovecot, Postfix and…8.8
• CVE-2023-3411The Image Map Pro – Drag-and-drop Builder for Interactive Im…4.3
• CVE-2023-34110Flask-AppBuilder is an application development framework, bu…2.7
• CVE-2023-34111The `Release PR Merged` workflow in the github repo taosdata…9.8
• CVE-2023-34112JavaCPP Presets is a project providing Java distributions of…8.8
• CVE-2023-34113Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-34114Exposure of resource to wrong sphere in Zoom for Windows and…6.5