Forked template compiler for Vue with CVE-2024-9506 patch
npm install @lastboy/vue2-template-compiler> Fork of vue-template-compiler@2.7.16 with patched CVE-2024-9506, a ReDoS vulnerability in the parseHTML function.
This package is automatically built alongside @lastboy/vue2 and provides a secure template compiler compatible with that runtime.
This fork is intended for teams that still rely on Vue 2 but need to meet strict security compliance standards. It is API-compatible with the original vue-template-compiler and can be used as a drop-in replacement.
---
This compiler has been tested against a malicious HTML payload known to exploit the vulnerable regex in parseHTML. The test uses compiler.compile() directly with a crafted tag payload to measure parsing time and detect exponential regex backtracking.
Run the test:
``bash`
pnpm test:patch
This runs a benchmark using:
- ⚠️ vue-template-compiler@2.7.16 (unpatched)
- ✅ This forked, patched compiler
If compilation takes longer than 1000ms, the test reports the version as vulnerable.
The patched compiler finishes in under 20ms and is marked as safe.
> ⚠️ Warnings may still appear in both cases due to malformed input — this is expected and confirms the compiler was invoked.
---
_This documentation is based on the original vue-template-compiler package and applies fully to this fork unless otherwise noted._
This compiler has been tested against a malicious HTML payload known to exploit the vulnerable regex in parseHTML. The test uses compiler.compile() directly with a crafted