Executive brief
nope-validator is a JavaScript library used by developers to validate data objects, such as checking if a string is a valid email or URL. A flaw in how it processes these checks allows an attacker to provide a specially crafted input that causes the system to hang or crash. This results in a denial-of-service, potentially making the application using this library unavailable to legitimate users.
Technical details
The nope-validator library contains inefficient regular expressions in its email and URL validation logic that are susceptible to Regular Expression Denial of Service (ReDoS). Specifically, the emailRegex and certain URL patterns exhibit exponential backtracking when processing specifically crafted malicious strings. An attacker can exploit this by submitting a long, complex string to an application that uses nope-validator for input validation, leading to high CPU consumption and thread blocking. This is a remote, unauthenticated attack that impacts service availability. The issue is fixed in version 0.12.1 by updating the underlying regex patterns to remove ambiguity.
Affected products
- ftonato nope-validator <= 0.11.3
Timeline
- 2020-11-30: disclosed: Vulnerability reported to maintainer by GitHub Security Lab
- 2021-04-09: patched: Fixes for email and URL regex committed to repository
- 2024-10-26: advisory: Public advisory published via GitHub and OSV