Executive brief
Vue is a popular JavaScript framework for building web applications. A Regular Expression Denial of Service (ReDoS) vulnerability in the parseHTML function allows attackers to cause excessive CPU consumption and application slowdown by submitting specially crafted HTML templates with mismatched tags (e.g., a script tag closed with textarea). This can make Vue applications unresponsive or unavailable during template parsing.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS, CWE-1333) flaw in the html-parser.ts file within Vue's parseHTML() function. The vulnerable regex is used to validate closing tags for script, style, and textarea elements. When an attacker provides a template with a mismatched tag pair—such as an opening <script> tag followed by a closing </textarea> tag preceded by thousands of '<' characters—the inefficient regex causes exponential backtracking, consuming excessive CPU resources. The attack requires user-controlled template input or the ability to inject templates into a Vue application; no authentication is needed. The impact is a denial of service through application slowdown or hang during template parsing. Vue 2 (versions ≥2.0.0 <3.0.0) is affected and reached end-of-life without an official patch; Vue 3 (≥3.0.0-alpha.0) is not affected.
Affected products
- Vue.js Vue >=2.0.0 <3.0.0
Timeline
- 2024-10-15: disclosed
- other: Vue 2 reached end-of-life; no official patch available