Executive brief
is-my-json-valid is a popular JavaScript library used to validate JSON data against schemas, including email address validation. The library uses a poorly designed regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) attacks. An attacker can submit a specially crafted JSON file that causes the validation process to hang, consuming 100% CPU for extended periods (approximately 10 seconds for a 90KB input), effectively disabling any service that depends on this library for validation.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) attack in the email validation regex pattern. The vulnerable regex `/^\S+@\S+$/` uses overlapping quantifiers (`\S+` followed by `@` and `\S+` again) that cause exponential backtracking when the regex engine attempts to match an invalid input. The attack requires only network access to send a malicious JSON payload to an application using the vulnerable library; no authentication or special privileges are needed. When a JSON object with an email-format field is validated against a long string of non-whitespace characters lacking an `@` symbol, the regex engine exhausts exponential time trying alternative character groupings before ultimately failing to match. The fix replaces the inefficient regex with a simpler, bounded pattern and delegates complex email validation to a separate library. Patched versions 1.4.1 and 2.17.2 are available.
Affected products
- npm is-my-json-valid <1.4.1 and >=2.0.0 <2.17.2
Timeline
- 2018-02-13: disclosed
- 2018-02-14: patched
- 2022-01-06: advisory