Executive brief
Sync-in Server is a file synchronization backend that allows authenticated users to diff and sync files across clients. A vulnerability in the sync diff endpoint accepts user-supplied regex patterns without validating their complexity, allowing an attacker to craft patterns that trigger catastrophic backtracking and block the Node.js event loop. An authenticated attacker can send repeated malicious requests to keep the service unavailable to legitimate users, requiring administrative intervention to restore service.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the sync diff endpoint (`POST /api/app/sync/operation/diff/:id`). The `pathFilters` parameter is directly transformed into a RegExp object without validation of regex complexity or safety. During diff generation, the compiled regex is executed synchronously via `.test()` against file paths. Catastrophic-backtracking patterns such as `^(a+)+b` cause nested quantifiers to exhaust backtracking possibilities, blocking the Node.js event loop for the duration of evaluation. An authenticated user with desktop sync access can exploit this by sending a diff request with an unsafe regex pattern. In single-process deployments, this blocks all HTTP endpoints including health checks. The attack can be repeated to sustain denial of service. Remediation requires validating regex patterns before compilation using a safety checker like `safe-regex2` to reject unsafe nested quantifiers.
Affected products
- Sync-in Sync-in Server v2.3.0
Timeline
- 2026-09-22: disclosed