Executive brief
CommonRegexJS is a JavaScript library for matching common regular expressions like email addresses and URLs. The library contains multiple regular expressions vulnerable to ReDoS (Regular Expression Denial of Service) attacks, which can cause the application using it to hang or become unresponsive when processing maliciously crafted input. As of the advisory publication, no patches are available.
Technical details
CommonRegexJS contains one or more regular expressions vulnerable to catastrophic backtracking, classified as CWE-1333 (Regular Expression Denial of Service). The vulnerability can be exploited by providing specially crafted input to regex patterns in the library, causing exponential time complexity in pattern matching. The attack requires network access to an application that uses CommonRegexJS to process untrusted input, with no authentication or user interaction required. An attacker can trigger denial of service by providing input that causes excessive backtracking, making the application unresponsive. No patches have been released as of the advisory date.
Affected products
- CommonRegexJS CommonRegexJS 0.3.1 and all earlier versions
Timeline
- 2020-11-30: disclosed: GitHub Security Lab team contacted maintainer
- 2024-10-26: advisory: GHSA-pmvv-57rg-5g86 published with CVE-2020-26305