What is GHSA-rv73-9c8w-jp4c?

GHSA-rv73-9c8w-jp4c is a security advisory published by GitHub Security Advisories with Medium severity. validate.js Regular Expression Denial of Service vulnerability

Which CVE IDs does GHSA-rv73-9c8w-jp4c cover?

GHSA-rv73-9c8w-jp4c covers the following CVE IDs: CVE-2020-26308. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-rv73-9c8w-jp4c?

GHSA-rv73-9c8w-jp4c affects 1 product, including: npm/validate.js:\u003c= 0.13.1.

GHSA-rv73-9c8w-jp4cMedium

validate.js Regular Expression Denial of Service vulnerability

Vendor

GitHub Security Advisories

Published

October 26, 2024

Last Modified

October 28, 2024

🔗 CVE IDs covered (1)

CVE-2020-26308 →

📋 Description

Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

🎯 Affected products1

npm/validate.js:<= 0.13.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-26308
https://github.com/ansman/validate.js/issues/342
https://securitylab.github.com/advisories/GHSL-2020-302-redos-validate.js
https://github.com/advisories/GHSA-rv73-9c8w-jp4c