Executive brief
The validator.js library is a widely-used JavaScript utility for input validation. A regular expression parsing flaw in the isURL validation method can be exploited to cause excessive CPU consumption, disrupting any application or service that depends on this library for validating user-submitted URLs.
Technical details
A regular expression denial of service (ReDoS) vulnerability exists in the isURL method of validator.js versions prior to 3.22.1. The vulnerable regex pattern fails to efficiently handle specially crafted URL strings, causing catastrophic backtracking and excessive CPU consumption. An unauthenticated attacker can trigger this via any code path that calls isURL on untrusted input (typically form submissions or API requests). The vulnerability was fixed in version 3.22.1 by optimizing the regex pattern to prevent backtracking.
Affected products
- chriso validator.js before 3.22.1
Timeline
- 2020-08-31: disclosed
- 2020: patched: Fixed in version 3.22.1