GHSA-4hpf-3wq7-5rprMediumCVSS 5.3
Regular expression deinal of service (ReDoS) in is-my-json-valid
🔗 CVE IDs covered (1)
📋 Description
It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
🎯 Affected products2
- npm/is-my-json-valid:>= 2.0.0, < 2.17.2
- npm/is-my-json-valid:< 1.4.1
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2018-1107
- https://github.com/mafintosh/is-my-json-valid/pull/159
- https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976
- https://bugzilla.redhat.com/show_bug.cgi?id=1546357
- https://snyk.io/vuln/npm:is-my-json-valid:20180214
- https://github.com/advisories/GHSA-4hpf-3wq7-5rpr