GHSA-xx4c-jj58-r7x6 Inefficient Regular Expression Complexity in Validator.js
An attacker can cause a denial of service by exploiting inefficient regular expressions in the validator library's trim functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xx4c-jj58-r7x6?
GHSA-xx4c-jj58-r7x6 is a denial of service vulnerability in validator, published on 19 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers.
Patches
The problem has been patched in validator 13.7.0
Which versions are affected by GHSA-xx4c-jj58-r7x6?
2 open source packages ship an affected version, including validator.
| Package | Affected | Fixed in |
|---|---|---|
validator npm | From 11.1.0 | 13.7.0 |
validator npm | From 11.1.0 | 13.7.0 |
How do I fix GHSA-xx4c-jj58-r7x6?
Upgrade validator to 13.7.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-xx4c-jj58-r7x6 being exploited?
There is no known exploitation of GHSA-xx4c-jj58-r7x6 in the wild and no public exploit code.