# CVE-2018-1107: npm is-my-json-valid regular expression denial of service

Source: https://junglewise.ai/threats/cve-2018-1107-npm-is-my-json-valid-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-1107 · Severity: low · CVSS 3.1 · Published 2022-01-06

is-my-json-valid is a popular JavaScript library used to validate JSON data against schemas, including email address validation. The library uses a poorly designed regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) attacks. An attacker can submit a specially crafted JSON file that causes the validation process to hang, consuming 100% CPU for extended periods (approximately 10 seconds for a 90KB input), effectively disabling any service that depends on this library for validation.

Technologies: [is-my-json-valid (npm)](https://junglewise.ai/threats/technologies/is-my-json-valid). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-1107 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-1107 being exploited in the wild.

**How severe is CVE-2018-1107?** Low severity, with a CVSS score of 3.1, published 6 January 2022.

**Which products and versions are affected?** is-my-json-valid (npm) <1.4.1 and >=2.0.0 <2.17.2.

**Is there a fix for CVE-2018-1107?** A patch was published on 2018-02-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-1107 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-1107?** Check whether you run is-my-json-valid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) attack in the email validation regex pattern. The vulnerable regex `/^\S+@\S+$/` uses overlapping quantifiers (`\S+` followed by `@` and `\S+` again) that cause exponential backtracking when the regex engine attempts to match an invalid input. The attack requires only network access to send a malicious JSON payload to an application using the vulnerable library; no authentication or special privileges are needed. When a JSON object with an email-format field is validated against a long string of non-whitespace characters lacking an `@` symbol, the regex engine exhausts exponential time trying alternative character groupings before ultimately failing to match. The fix replaces the inefficient regex with a simpler, bounded pattern and delegates complex email validation to a separate library. Patched versions 1.4.1 and 2.17.2 are available.

## Affected products

- npm is-my-json-valid <1.4.1 and >=2.0.0 <2.17.2

## Identifiers

- CVE-2018-1107
- GHSA-4hpf-3wq7-5rpr

## Timeline

- 2018-02-13: disclosed
- 2018-02-14: patched
- 2022-01-06: advisory

## References

- [https://github.com/mafintosh/is-my-json-valid/pull/159](https://github.com/mafintosh/is-my-json-valid/pull/159)
- [https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976](https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976)
- [https://bugzilla.redhat.com/show_bug.cgi?id=1546357](https://bugzilla.redhat.com/show_bug.cgi?id=1546357)
- [https://snyk.io/vuln/npm:is-my-json-valid:20180214](https://snyk.io/vuln/npm:is-my-json-valid:20180214)

## Related threats

- [is-my-json-valid regular expression denial of service](https://junglewise.ai/threats/is-my-json-valid-regular-expression-denial-of-service-34bc4850)
- [is-my-json-valid ReDoS in utc-millisec regex](https://junglewise.ai/threats/is-my-json-valid-redos-in-utc-millisec-regex-a2c670d1)
- [is-my-json-valid regular expression denial of service in email validation](https://junglewise.ai/threats/cve-2016-2537-is-my-json-valid-regular-expression-denial-of-service-in-email)