CVE-2026-58270: Sync-in Server ReDoS via unsanitized regex in pathFilters

CVE-2026-58270 · Severity: medium · CVSS 6.5 · Published 2026-09-21

Sync-in Server is a file synchronization backend that allows authenticated users to diff and sync files across clients. A vulnerability in the sync diff endpoint accepts user-supplied regex patterns without validating their complexity, allowing an attacker to craft patterns that trigger catastrophic backtracking and block the Node.js event loop. An authenticated attacker can send repeated malicious requests to keep the service unavailable to legitimate users, requiring administrative intervention to restore service.

Technologies: @sync-in/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-58270 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58270 being exploited in the wild.
How severe is CVE-2026-58270?
Medium severity, with a CVSS score of 6.5, published 21 September 2026.
Which products and versions are affected?
@sync-in/server (npm) <= 2.3.0, SEMVER:introduced=0,fixed=2.4.0.
Is there a fix for CVE-2026-58270?
Yes. @sync-in/server (npm): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58270 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58270?
Check whether you run @sync-in/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @sync-in/server (npm): upgrade to 2.4.0 or later
    npm install @sync-in/server@2.4.0

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the sync diff endpoint (`POST /api/app/sync/operation/diff/:id`). The `pathFilters` parameter is directly transformed into a RegExp object without validation of regex complexity or safety. During diff generation, the compiled regex is executed synchronously via `.test()` against file paths. Catastrophic-backtracking patterns such as `^(a+)+b` cause nested quantifiers to exhaust backtracking possibilities, blocking the Node.js event loop for the duration of evaluation. An authenticated user with desktop sync access can exploit this by sending a diff request with an unsafe regex pattern. In single-process deployments, this blocks all HTTP endpoints including health checks. The attack can be repeated to sustain denial of service. Remediation requires validating regex patterns before compilation using a safety checker like `safe-regex2` to reject unsafe nested quantifiers.

Affected products

  • Sync-in Sync-in Server v2.3.0

Identifiers

  • CVE-2026-58270
  • GHSA-jx63-h26r-8cph

Timeline

  • 2026-09-22: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.