Executive brief
Validator.js is a widely-used JavaScript library for validating and sanitizing input data. A vulnerability in its trim and rtrim sanitizers allows an attacker to send crafted input that causes the application to consume excessive CPU, resulting in denial of service or performance degradation for legitimate users.
Technical details
This vulnerability is a Regular Expression Denial of Service (ReDoS) issue affecting the rtrim and trim sanitizer functions in Validator.js versions 11.1.0 through 13.6.0. The vulnerable regular expressions exhibit inefficient computational complexity (CWE-1333) that can be exponential in worst-case scenarios when processing adversarial input. An unauthenticated attacker can exploit this via a network request by sending specially crafted strings to any application endpoint that uses the affected sanitizers, causing the regex engine to consume excessive CPU and potentially hang or degrade performance. The issue is fixed in version 13.7.0 and later.
Affected products
- npm validator >=11.1.0, <13.7.0
Timeline
- 2021-11-19: disclosed
- 2021-11-19: patched: Fixed in validator 13.7.0