Regular Expression Denial of Service in validator · CVE-2014-8882 · GitHub Advisory Database · GitHub

Regular Expression Denial of Service in validator

High severity GitHub Reviewed Published Aug 31, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

validator (npm)

Affected versions

< 3.22.1

Patched versions

3.22.1

Description

Versions of validator prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the isURL method.

Recommendation

Update to version 3.22.1 or later.

References

Reviewed Aug 31, 2020

Published to the GitHub Advisory Database Aug 31, 2020

Last updated Jan 9, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H