Executive brief
v8n is a popular JavaScript validation library used to check and validate data in applications. The library contains inefficient regular expressions in its lowercase() and uppercase() validation functions that can be exploited to cause a denial of service, where an attacker sends a specially crafted input that makes the validation process hang and consume server resources, disrupting service availability for legitimate users.
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability caused by catastrophic backtracking in the lowercase() and uppercase() regex patterns. The vulnerable component is the string validation regex logic in v8n. An attacker can trigger the vulnerability by submitting a crafted payload (e.g., 'a' repeated multiple times followed by 'A') to any validation function using these patterns; no authentication or user interaction is required beyond sending the malicious input. A 32-character payload can cause the validation function to hang for over 29 seconds, effectively blocking the application. The vulnerability was patched in version 1.5.1.
Affected products
- v8n v8n before 1.5.1
Timeline
- 2022-08-02: disclosed
- 2022-10-07: advisory
- 2022: patched: Version 1.5.1 released