Skip to content
High-Severity DoS Vulnerability in Node.js shell-quote Package Disclosed

High-Severity DoS Vulnerability in Node.js shell-quote Package Disclosed

First seen 25 Jun 2026, 09:23 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 26, 2026 at 09:09 UTC
  • •CVE-2026-13311 affects Node.js shell-quote versions up to 1.8.4.
  • •The vulnerability allows remote denial of service via crafted input strings.
  • •No active exploitation has been reported as of June 2026, but PoC code is available.

CVE-2026-13311 is a high-severity Denial of Service (DoS) vulnerability affecting the Node.js package shell-quote (versions up to 1.8.4). It allows unauthenticated attackers to exploit the quadratic algorithmic complexity in the parse() function, blocking the Node.js event loop and causing service outages. The vulnerability does not involve code execution or data disclosure, impacting only availability. Affected systems include any Node.js services using shell-quote for user input parsing. The vulnerability was published on June 25, 2026, and is not currently known to be exploited in the wild, although proof-of-concept code is available. Users are advised to upgrade to shell-quote version 1.8.5 or later to mitigate the risk.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 135d ago How this analysis works

Timeline

2026-06-25
CVE-2026-13311 published
A high-severity DoS vulnerability in the shell-quote package was disclosed, affecting versions up to 1.8.4.
Rescana
2026-06-25
NVD entry created for CVE-2026-13311
The National Vulnerability Database published an entry for CVE-2026-13311, detailing its impact and mitigation.
nvd.nist.gov

More articles in this cluster (3)

Following this threat?

Track CVE-2026-13311 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3