Regular Expression Denial of Service (ReDoS)

Disclosed: 2019-04-03 20:00:47 By danny_grander To nodejs-ecosystem
Medium
Vulnerability Details
The issue was already fixed. **Module:** is-my-json-valid **Summary:** Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. It used a regular expression (/^\S+@\S+$/) in order to validate emails. This can cause an impact of about 10 seconds matching time for data 90K characters long. **Description:** Regex: formats.js exports[‘email’] = /^\S+@\S+$/ (introduced in 2014, 34a1a706) ## Supporting Material/References: * https://github.com/mafintosh/is-my-json-valid/pull/159 * https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976 ## Impact Denial of service through blocking the event loop.
Actions
View on HackerOne
Report Stats
  • Report ID: 317548
  • State: Closed
  • Substate: resolved
  • Upvotes: 2
Share this report