CVE-2018-1107 Regular expression deinal of service (ReDoS) in is-my-json-valid
An attacker can cause excessive CPU consumption and denial of service by submitting specially crafted JSON data to applications using this validation library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1107?
CVE-2018-1107 is a medium-severity denial of service vulnerability in nodejs-is-my-json-valid, published on 30 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
Weakness: CWE-400
Which versions are affected by CVE-2018-1107?
4 open source packages ship an affected version, including is-my-json-valid. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
is-my-json-valid npm | All versions | 1.4.1 |
is-my-json-valid npm | All versions | 1.4.1 |
is-my-json-valid npm | From 2.0.0 | 2.17.2 |
is-my-json-valid npm | From 2.0.0 | 2.17.2 |
Products include Is-My-Json-Valid Project Is-My-Json-Valid.
How do I fix CVE-2018-1107?
Upgrade is-my-json-valid to a fixed version for your release line: 1.4.1 or 2.17.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-1107 being exploited?
There is no known exploitation of CVE-2018-1107 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1792476292, GHSA-4hpf-3wq7-5rpr.