CVE-2026-73413: Shescape JavaScript Library DoS Vulnerability

CVE-2026-73413 Overview

CVE-2026-73413 is a denial-of-service vulnerability in Shescape, a shell escape library for JavaScript. The flaw exists in the flag-protection loop within the compose function in src/internal/compose.js. When flagProtection is enabled (the default), the loop repeatedly joins and slices flag fragments, producing quadratic time complexity relative to input size. The issue affects the escape, escapeAll, quote, and quoteAll APIs. An attacker who supplies large untrusted input containing many flag fragments can exhaust CPU resources. The vulnerability affects versions from 2.1.11 up to (but not including) 2.1.14 and 3.0.1. It is classified under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Remote attackers can trigger sustained CPU exhaustion by submitting crafted input containing many flag fragments to any application invoking Shescape's escape or quote APIs.

Affected Products

Shescape versions 2.1.11 through 2.1.13
Shescape version 3.0.0
Any JavaScript application depending on vulnerable Shescape releases with default flagProtection enabled

Discovery Timeline

2026-08-12 - CVE-2026-73413 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73413

Vulnerability Analysis

Shescape sanitizes shell arguments to prevent command injection when Node.js applications spawn child processes. The compose function in src/internal/compose.js contains a loop that inspects flag fragments produced by flagFn(arg). On each iteration, the loop calls rest.join("") to reassemble the remaining fragments and then destructures the array to advance to the next fragment. Because join performs work proportional to the total remaining string length on every iteration, processing degrades to O(n²) as the number of fragments grows.

The defect impacts all four public escape APIs: escape, escapeAll, quote, and quoteAll. Any application that passes untrusted, user-controlled data through these functions inherits the vulnerability.

Root Cause

The root cause is an algorithmic complexity defect [CWE-400]. The original implementation repeatedly re-joined the entire remaining fragment array inside a while loop instead of scanning fragments in a single linear pass. The fix replaces the destructuring loop with an index-based for loop that iterates once and defers the single join call until after the correct offset has been located.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends a single large payload containing many flag-like fragments to any application endpoint that forwards the input into a Shescape escape or quote call. The resulting quadratic processing consumes CPU until the request completes or times out. Repeated requests can render the host service unresponsive.

javascript

// Security patch in src/internal/compose.js (PR #2649 / #2651)
// Source: https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de
  return (arg) => {
-    let [preFlag, , ...rest] = flagFn(arg);
-    while (rest.length > 0 && escapeFn(preFlag) === "") {
-      arg = rest.join("");
-      [preFlag, , ...rest] = rest;
+    const fragments = flagFn(arg);
+
+    let idx = 0;
+    for (; idx < fragments.length - 2; idx += 2) {
+      const escapedFragment = escapeFn(fragments[idx]);
+      if (escapedFragment !== "") {
+        break;
+      }
    }

+    arg = fragments.slice(idx).join("");
    return escape(arg);
  };
}

The patched code replaces the repeated join/destructure pattern with a single linear scan followed by one slice and join, restoring linear time complexity.

Detection Methods for CVE-2026-73413

Indicators of Compromise

Sustained single-core CPU saturation in Node.js processes correlated with HTTP requests carrying oversized body or query parameters.
Elevated request-latency percentiles on endpoints that pass user input to child_process.spawn, exec, or wrappers built on Shescape.
Repeated inbound payloads containing long sequences of -, --, or / flag prefixes concatenated together.

Detection Strategies

Perform a software composition analysis scan and flag any dependency tree entry for shescape matching versions >=2.1.11 <2.1.14 or 3.0.0.
Instrument application performance monitoring to alert on synchronous event-loop stalls exceeding a defined threshold when Shescape APIs are on the call stack.
Review web application firewall logs for request bodies with abnormally high ratios of flag-prefix characters to total content.

Monitoring Recommendations

Track process.cpuUsage() and event-loop lag metrics on services that invoke escape, escapeAll, quote, or quoteAll.
Enable request-duration histograms per endpoint and alert on tail-latency regressions after upstream input changes.
Aggregate Node.js runtime telemetry into a centralized data lake to correlate resource-exhaustion patterns across service instances.

How to Mitigate CVE-2026-73413

Immediate Actions Required

Upgrade Shescape to version 2.1.14 (for 2.x deployments) or 3.0.1 (for 3.x deployments) without delay.
Audit direct and transitive dependencies for vulnerable Shescape versions using npm ls shescape or equivalent tooling.
Impose request body size and parameter length limits on endpoints that forward input to shell escape routines.

Patch Information

The maintainer released fixes in Shescape v2.1.14 and Shescape v3.0.1. The corrective changes are tracked in PR #2649 and PR #2651, with commits 43d70b5 and b4b34c3. Full details appear in GHSA-gm3r-q2wp-hw87.

Workarounds

Disable flagProtection by explicitly passing { flagProtection: false } when the calling code does not require flag-injection defense.
Enforce strict input length caps before passing arguments into Shescape APIs.
Place rate limiting and request-timeout controls in front of any endpoint that reaches shell escape logic.

bash

# Upgrade to a fixed release
npm install shescape@2.1.14
# or, for the 3.x branch
npm install shescape@3.0.1

# Verify no vulnerable versions remain in the dependency tree
npm ls shescape