# is-my-json-valid ReDoS in utc-millisec regex

Source: https://junglewise.ai/threats/is-my-json-valid-redos-in-utc-millisec-regex-a2c670d1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2018-07-31

is-my-json-valid is a Node.js library for validating JSON data against schemas. The library contains a flawed regular expression in the utc-millisec validator that can be exploited with a specially crafted string to cause the application to hang, blocking the event loop and making the service unresponsive.

Technologies: [is-my-json-valid (npm)](https://junglewise.ai/threats/technologies/is-my-json-valid). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 31 July 2018.

**Which products and versions are affected?** is-my-json-valid (npm) <2.12.4.

**Is there a fix for This vulnerability?** A patch was published on 2012.4: Fix available in version 2.12.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run is-my-json-valid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a regular expression denial of service (ReDoS) flaw in the utc-millisec format validator of is-my-json-valid versions prior to 2.12.4. The vulnerable regular expression exhibits excessive backtracking when processing certain malformed input strings, causing the event loop to block indefinitely. An attacker can trigger this by providing a crafted JSON string to an application that validates input using this library, resulting in a denial of service condition. The fix is available in version 2.12.4 and later.

## Affected products

- npm is-my-json-valid <2.12.4

## Timeline

- 2018-07-31: disclosed
- 2012.4: patched: Fix available in version 2.12.4
- 2020-06-16: other: Advisory withdrawn as accidental duplicate

## Related threats

- [npm is-my-json-valid regular expression denial of service](https://junglewise.ai/threats/cve-2018-1107-npm-is-my-json-valid-regular-expression-denial-of-service)
- [is-my-json-valid regular expression denial of service](https://junglewise.ai/threats/is-my-json-valid-regular-expression-denial-of-service-34bc4850)
- [is-my-json-valid regular expression denial of service in email validation](https://junglewise.ai/threats/cve-2016-2537-is-my-json-valid-regular-expression-denial-of-service-in-email)