Executive brief
Vuelidate is a form validation library used in Vue.js applications. The library contains an inefficient regular expression in its URL validation function that can be exploited to cause a denial of service by consuming excessive CPU resources when processing specially crafted input. An attacker could disrupt service availability by submitting malicious URL strings to any form using the affected validator.
Technical details
This is a ReDoS (regular expression denial of service) vulnerability in the url() validator function of the @vuelidate/validators package, caused by inefficient regular expression complexity (CWE-1333, CWE-400). An attacker who can provide crafted input to the url validation function can cause the application to consume excessive CPU cycles due to catastrophic backtracking in the regex engine. No authentication is required—the attack surface is any publicly exposed form field using the vulnerable url() validator. The vulnerability affects all versions up to and including 2.0.0-alpha.21, and was patched in version 2.0.0-alpha.22 with an updated URL validation regex.
Affected products
- Vuelidate @vuelidate/validators < 2.0.0-alpha.22
Timeline
- 2021-09-15: disclosed
- 2021-09-20: advisory
- 2021-09-20: patched: Fixed in version 2.0.0-alpha.22