Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 19 August 2020.

Which products and versions are affected?

is-my-json-valid (npm) SEMVER:introduced=2.0.0,fixed=2.17.2.

Is there a fix for This vulnerability?

Yes. is-my-json-valid (npm): upgrade to 2.17.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run is-my-json-valid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

is-my-json-valid regular expression denial of service

Severity: info · Published 2020-08-19

is-my-json-valid is a JavaScript library used to validate JSON data against schemas. A regular expression in the library is susceptible to catastrophic backtracking, which could allow an attacker to cause a denial of service by providing specially crafted input that forces excessive CPU consumption during validation.

Technologies: is-my-json-valid (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 19 August 2020.
Which products and versions are affected?: is-my-json-valid (npm) SEMVER:introduced=2.0.0,fixed=2.17.2.
Is there a fix for This vulnerability?: Yes. is-my-json-valid (npm): upgrade to 2.17.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run is-my-json-valid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

is-my-json-valid (npm): upgrade to 2.17.2 or later
```
npm install is-my-json-valid@2.17.2
```

Technical details

The vulnerability is a regular expression denial of service (ReDoS) in the is-my-json-valid JSON schema validation library, caused by problematic regex patterns that exhibit catastrophic backtracking behavior. The vulnerable regexes are used during JSON schema validation, which typically runs automatically when processing untrusted input without additional authentication or network access restrictions. An attacker can craft malicious JSON input containing strings that trigger exponential backtracking in the validation regex, causing high CPU consumption and denial of service. The issue was addressed in versions 1.4.1 and 2.17.2 through improved regex patterns that avoid catastrophic backtracking, as demonstrated in PR #159 which explicitly addresses this issue.

Affected products

mafintosh is-my-json-valid 0 to 1.4.0 and 2.0.0 to 2.17.1

Timeline

2020-08-19: disclosed
2018-02-14: patched: Fix merged in PR #159 with commit b3051b2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.