Executive brief
The is-url JavaScript library validates whether strings are valid URLs. A flaw in its regular expression pattern can cause excessive CPU consumption when processing specially crafted malicious input, potentially causing denial of service on web applications and Node.js servers that depend on this library.
Technical details
The is-url library contained a regular expression vulnerability (ReDoS – Regular Expression Denial of Service) in its URL validation logic in index.js. The vulnerability stems from catastrophic backtracking in the regex pattern when processing certain malicious input strings. An unauthenticated remote attacker can send specially crafted URLs to trigger excessive regex evaluation, causing high CPU consumption and application hang or crash. The vulnerability affects all versions up to 1.2.2 and was fixed in version 1.2.3 by splitting the vulnerable regex into multiple safe patterns using a two-step validation approach.
Affected products
- Segment is-url up to 1.2.2
Timeline
- 2023-02-04: disclosed: Advisory published on OSV/GitHub
- 2018-03-20: patched: Fix merged in commit 149550935c63a98c11f27f694a7c4a9479e53794, released in v1.2.3
- 2023-02-10: other: GitHub security review completed