CVE-2018-1107: npm is-my-json-valid regular expression denial of service

CVE-2018-1107 · Severity: low · CVSS 3.1 · Published 2022-01-06

is-my-json-valid is a popular JavaScript library used to validate JSON data against schemas, including email address validation. The library uses a poorly designed regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) attacks. An attacker can submit a specially crafted JSON file that causes the validation process to hang, consuming 100% CPU for extended periods (approximately 10 seconds for a 90KB input), effectively disabling any service that depends on this library for validation.

Technologies: is-my-json-valid (npm). Vendors: npm.

Quick answers

Is CVE-2018-1107 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2018-1107 being exploited in the wild.
How severe is CVE-2018-1107?
Low severity, with a CVSS score of 3.1, published 6 January 2022.
Which products and versions are affected?
is-my-json-valid (npm) <1.4.1 and >=2.0.0 <2.17.2.
Is there a fix for CVE-2018-1107?
A patch was published on 2018-02-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-1107 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2018-1107?
Check whether you run is-my-json-valid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) attack in the email validation regex pattern. The vulnerable regex `/^\S+@\S+$/` uses overlapping quantifiers (`\S+` followed by `@` and `\S+` again) that cause exponential backtracking when the regex engine attempts to match an invalid input. The attack requires only network access to send a malicious JSON payload to an application using the vulnerable library; no authentication or special privileges are needed. When a JSON object with an email-format field is validated against a long string of non-whitespace characters lacking an `@` symbol, the regex engine exhausts exponential time trying alternative character groupings before ultimately failing to match. The fix replaces the inefficient regex with a simpler, bounded pattern and delegates complex email validation to a separate library. Patched versions 1.4.1 and 2.17.2 are available.

Affected products

  • npm is-my-json-valid <1.4.1 and >=2.0.0 <2.17.2

Identifiers

  • CVE-2018-1107
  • GHSA-4hpf-3wq7-5rpr

Timeline

  • 2018-02-13: disclosed
  • 2018-02-14: patched
  • 2022-01-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.