The diff (jsdiff) package's parsePatch and applyPatch functions accept patches whose filename headers contain the line break characters \r, \u2028, or \u2029, which causes parsePatch to enter an infinite loop.

This results in unbounded memory consumption until the process crashes, resulting in a potential DoS vulnerability. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide protection.

Update nodejs-diff to version 5.2.2 which includes the fix for this vulnerability.

Upstream fix PR:
https://github.com/kpdecker/jsdiff/pull/649

Security advisory:
https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx