Regular Expression Denial of Service (ReDoS)
Medium
Vulnerability Details
The issue was already fixed.
**Module:** is-my-json-valid
**Summary:**
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. It used a regular expression (/^\S+@\S+$/) in order to validate emails. This can cause an impact of about 10 seconds matching time for data 90K characters long.
**Description:**
Regex:
formats.js
exports[‘email’] = /^\S+@\S+$/
(introduced in 2014, 34a1a706)
## Supporting Material/References:
* https://github.com/mafintosh/is-my-json-valid/pull/159
* https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976
## Impact
Denial of service through blocking the event loop.
Actions
View on HackerOneReport Stats
- Report ID: 317548
- State: Closed
- Substate: resolved
- Upvotes: 2