Executive brief
validator.js is a widely-used input validation library for JavaScript. The library contains an inefficient regular expression in its string trimming function that can be exploited to cause a denial of service by making the library consume excessive CPU resources when processing specially crafted input strings.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) issue caused by an inefficient regular expression pattern in the rtrim function prior to version 13.7.0. The vulnerable regex exhibits catastrophic backtracking when processing certain malicious input patterns, allowing an attacker to cause the validation library to hang or consume significant CPU resources. The attack requires network access to an application using the affected version of validator.js, with no authentication required. The fix, committed in version 13.7.0, removes the problematic regex pattern in favor of a more efficient implementation. CWE-1333 (Inefficient Regular Expression Complexity).
Affected products
- validatorjs validator.js prior to 13.7.0
Timeline
- 2021-11-03: disclosed
- 2021-11-03: patched: Fixed in version 13.7.0