Executive brief
personnummer/js is a JavaScript library that validates Swedish personal identity numbers (personnummer). A flaw in the validation regex allows acceptance of invalid personnummer values where the first three digits of the last four digits are "000", which should be rejected according to the Swedish format specification. This could lead to acceptance of malformed identifiers in systems that rely on this library for identity validation.
Technical details
The vulnerability is an improper input validation flaw in the regular expression used to validate Swedish personnummer (personal identity numbers). The regex incorrectly allows the first three digits in the last four digits of a personnummer to be "000", which is invalid according to the Swedish format specification. An attacker or faulty system could pass malformed personnummer strings that bypass validation, potentially leading to inconsistent identity data in downstream systems. The vulnerability affects all versions prior to 3.1.0 (JavaScript) and similar versions across multiple language implementations. The fix involves correcting the regex pattern to properly reject personnummer with "000x" in the last four digits. No active exploitation in the wild has been reported.
Affected products
- personnummer personnummer <3.1.0
Timeline
- 2020-09-04: disclosed: Security advisory GHSA-vpgc-7h78-gx8f published
- 2020-09-04: patched: JavaScript version 3.1.0 released with fix