Regular expression deinal of service (ReDoS) in is-my-json-valid
Moderate severity
GitHub Reviewed
Published
Jan 6, 2022
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
>= 2.0.0, < 2.17.2
< 1.4.1
Patched versions
2.17.2
1.4.1
Description
Published by the National Vulnerability Database
Mar 30, 2021
Reviewed
Mar 31, 2021
Published to the GitHub Advisory Database
Jan 6, 2022
Last updated
Feb 1, 2023
It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
References