Is CVE-2025-26042 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-26042 being exploited in the wild.

How severe is CVE-2025-26042?

Medium severity, with a CVSS score of 4, published 31 March 2025.

Which products and versions are affected?

uptime-kuma (npm) SEMVER:introduced=1.15.0,last_affected=1.23.16.

Is there a fix for CVE-2025-26042?

A patch was published on 2025-03-29: Patch available in version 2.0.0-beta.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-26042 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-26042?

Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-26042: Uptime Kuma ReDoS in pushdeer and whapi notification providers

CVE-2025-26042 · Severity: medium · CVSS 4 · Published 2025-03-31

Uptime Kuma is a popular open-source status page and monitoring application. Administrators can configure notifications through pushdeer and whapi services. A ReDoS (Regular Expression Denial of Service) vulnerability in the URL validation logic allows an attacker to craft a malicious URL that causes the application to hang or become unresponsive, disrupting monitoring and alerting capabilities and degrading service availability.

Technologies: uptime-kuma (npm). Vendors: npm.

Quick answers

Is CVE-2025-26042 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-26042 being exploited in the wild.
How severe is CVE-2025-26042?: Medium severity, with a CVSS score of 4, published 31 March 2025.
Which products and versions are affected?: uptime-kuma (npm) SEMVER:introduced=1.15.0,last_affected=1.23.16.
Is there a fix for CVE-2025-26042?: A patch was published on 2025-03-29: Patch available in version 2.0.0-beta.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-26042 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-26042?: Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by catastrophic backtracking in the regex pattern `/\/*$/` used to strip trailing slashes from URLs in the pushdeer.js and whapi.js notification providers. When an attacker provides a URL containing a large number of repeated forward slashes followed by a non-slash character (e.g., "https://e" + "/" repeated 100,000 times + "@"), the regex engine enters excessive backtracking, consuming significant CPU resources and causing the web service to freeze for over 2 seconds. Attack requires administrator privileges to configure notifications through the web interface. The vulnerability affects versions 1.15.0 through 1.23.16, and 2.0.0-beta.0 and 2.0.0-beta.1, with a patch available in version 2.0.0-beta.2.

Affected products

Uptime Kuma Uptime Kuma >=1.15.0, <=1.23.16, 2.0.0-beta.0, 2.0.0-beta.1

Identifiers

CVE-2025-26042
GHSA-hx7h-9vf7-5xhg

Timeline

2025-03-31: disclosed
2025-03-29: patched: Patch available in version 2.0.0-beta.2

References

https://github.com/louislam/uptime-kuma/security/advisories/GHSA-hx7h-9vf7-5xhg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.