Uptime Kuma ReDoS in notification provider configuration

Executive brief

Uptime Kuma, a self-hosted monitoring tool, is vulnerable to a denial-of-service condition when processing notification settings. An administrator providing a specially crafted URL for notification services like PushDeer can trigger excessive CPU usage, potentially making the monitoring dashboard unresponsive. This could disrupt an organization's ability to monitor their infrastructure and receive critical alerts during an outage.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Uptime Kuma versions 1.23.0 and later due to inefficient regex patterns used to sanitize notification URLs. Specifically, the application used a greedy regex `\/* to strip trailing slashes in components like `pushdeer.js`. An attacker with administrative privileges can provide a crafted string (e.g., a long sequence of slashes followed by a non-slash character) that triggers catastrophic backtracking. This results in 100% CPU utilization and a denial-of-service state for the Node.js event loop. The issue was addressed by implementing a non-backtracking regex pattern.

Affected products

• louislam Uptime Kuma >= 1.23.0, < 2.0.0-dev.0

Timeline

• 2025-01-25: disclosed: Issue reported on GitHub
• 2025-01-26: patched: Fix merged into master branch
• 2025-03-17: advisory: Initial GHSA and CVE published

References

• https://github.com/louislam/uptime-kuma/issues/5574
• https://github.com/louislam/uptime-kuma/pull/5573
• https://github.com/louislam/uptime-kuma/commit/7a9191761dbef6551c2a0aa6eed5f693ba48d688
• https://github.com/louislam/uptime-kuma