JavaScriptSeverity: MediumStatus: Published

cron-parser: H/<step> (and H(min-max)/<step>) field expansion is still unbounded at parse time (heap-exhaustion DoS), incomplete fix of GHSA-r9w7-75q6-r884

The 256-value cap added in 5.10.1 for GHSA-r9w7-75q6-r884 runs after hashed fields are expanded, so it does not cover H/<step> or H(min-max)/<step>. Each such token expands to every value in its range before the cap applies, and a long expression of repeated tokens passed to CronExpressionParser.parse() can exhaust the Node.js heap and stop the process. Fixed in 5.10.2.