Executive brief
Valibot is a popular JavaScript schema validation library. Its emoji validation feature contains a flaw in its regular expression that allows attackers to cause a denial of service by submitting short, specially crafted strings (under 100 characters) that force the regex engine into excessive processing, consuming CPU for minutes and blocking legitimate requests. This is particularly dangerous because the attack input can bypass typical length-based restrictions.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting the EMOJI_REGEX pattern used by the emoji() validator. The root cause is catastrophic backtracking stemming from overlapping character classes—specifically, \p{Emoji_Presentation} overlaps with [\u{1F1E6}-\u{1F1FF}] and \p{Emoji_Modifier_Base} in the same alternation. When processing a crafted input that almost matches but ultimately fails, the regex engine explores an exponential number of matching paths, causing quadratic or exponential time complexity. The vulnerability is exploitable via any application endpoint that validates user-supplied strings with the emoji validator. A fix was patched in version 1.2.0 by making the character classes mutually exclusive using negative lookaheads.
Affected products
- Valibot Valibot >=0.31.0, <1.2.0
Timeline
- 2025-11-26: disclosed
- 2025-11-26: patched: Version 1.2.0