GHSA-x4hg-hfwf-p9mw @asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation
Attackers can cause denial of service by injecting malicious regex patterns into HTML input validation, freezing the application event loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-x4hg-hfwf-p9mw?
GHSA-x4hg-hfwf-p9mw is a denial of service vulnerability in @asymmetric-effort/nogginlessdom, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
The HTMLInputElement.checkValidity() method constructed a RegExp directly from the user-controlled pattern property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop.
Fix
Fixed in commit https://github.com/asymmetric-effort/NogginLessDom/commit/25a3cbac665fae5663f8b71c073b80c3152dbe7b on main. Added:
- Pattern length limit (1024 characters)
- Nested quantifier detection (
hasNestedQuantifiers) that rejects patterns like(a+)+before constructing the regex - Patterns exceeding limits are treated as non-matching (safe default)
Which versions are affected by GHSA-x4hg-hfwf-p9mw?
2 open source packages ship an affected version, including @asymmetric-effort/nogginlessdom.
| Package | Affected | Fixed in |
|---|---|---|
@asymmetric-effort/nogginlessdom npm | All versions | 0.0.22 |
@asymmetric-effort/nogginlessdom npm | All versions | 0.0.22 |
How do I fix GHSA-x4hg-hfwf-p9mw?
Upgrade @asymmetric-effort/nogginlessdom to 0.0.22 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-x4hg-hfwf-p9mw being exploited?
There is no known exploitation of GHSA-x4hg-hfwf-p9mw in the wild and no public exploit code.