Executive brief
express-validators is a validation library for Express.js that checks user-submitted data against defined rules. A vulnerability in its URL validation logic allows attackers to submit specially-crafted invalid URLs that cause the validation regex engine to consume excessive CPU time, effectively freezing the validation process and making the application unresponsive to legitimate requests.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the URL validation regex used by express-validators. The regex pattern suffers from catastrophic backtracking when processing specifically-crafted invalid URLs, causing exponential time complexity in matching attempts. An attacker can submit a URL with a specific pattern of characters (e.g., many sequential 'C' characters followed by an invalid character) to trigger excessive backtracking, consuming CPU resources. No authentication or special privileges are required; the attack occurs during URL validation on any request. The advisory indicates no fixed version is available, meaning users must apply workarounds or switch to alternative validation libraries.
Affected products
- express-validators express-validators all versions up to and including 1.0.4
Timeline
- 2020-10-14: disclosed
- 2021-05-10: advisory