Executive brief
skeemas is a validation library for Node.js applications. The library contains an inefficient regular expression in its URI validation logic that can be exploited to cause a denial of service (ReDoS attack) by providing specially crafted input, potentially slowing or halting URI validation operations.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) issue classified as inefficient regular expression complexity (CWE-1333). The vulnerable component is the URI format validator in validators/base.js. An attacker can supply a malicious URI argument that causes excessive backtracking in the regex engine, leading to high CPU consumption and service degradation. The vulnerability affects all versions before 1.2.5. A patch was released in commit 65e94eda62dc8dc148ab3e59aa2ccc086ac448fd on 2018-02-22, which improved the regex pattern to prevent ReDoS.
Affected products
- Prestaul skeemas before 1.2.5
Timeline
- 2018-02-22: other: Patch released (commit 65e94eda62dc8dc148ab3e59aa2ccc086ac448fd)
- 2023-01-11: disclosed