CVE-2020-26308

GHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.js

Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

Affected

ansman · validate.js

CVSS v4.0 GITHUB

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green

CVSS v4.0 GitHub

6.6 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.51% chance of exploitation in the next 30 days, 43rd percentile

Published

2024-10-26

Updated

2024-10-28

Proof-of-concept exploits (1)

• https://securitylab.github.com/advisories/GHSL-2020-302-redos-validate.js/

Security advisories

• https://securitylab.github.com/advisories/GHSL-2020-302-redos-validate.js
• advisories/GHSA-rv73-9c8w-jp4c
• ansman/validate.js/issues/342

References

• CVE Record
• NVD entry