Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 4 October 2023.

Which products and versions are affected?

express-zod-api (npm) SEMVER:introduced=0,fixed=10.0.0-beta1.

Is there a fix for This vulnerability?

Yes. express-zod-api (npm): upgrade to 10.0.0-beta1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run express-zod-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Zod email validation ReDoS vulnerability

Severity: low · CVSS 3.1 · Published 2023-10-04

Zod is a popular TypeScript-first schema validation library used in thousands of web applications. The email validation function contains a regular expression vulnerable to Regular Expression Denial of Service (ReDoS) attacks, allowing attackers to craft malicious email strings that cause the validation process to consume excessive CPU and freeze the server. Applications using express-zod-api (which depends on Zod) for API request validation are at risk of service disruption.

Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 4 October 2023.
Which products and versions are affected?: express-zod-api (npm) SEMVER:introduced=0,fixed=10.0.0-beta1.
Is there a fix for This vulnerability?: Yes. express-zod-api (npm): upgrade to 10.0.0-beta1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run express-zod-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

express-zod-api (npm): upgrade to 10.0.0-beta1 or later
```
npm install express-zod-api@10.0.0-beta1
```

Technical details

The vulnerability is an inefficient regular expression (CWE-1333) in Zod's email validation regex that exhibits exponential backtracking behavior when processing specially crafted input strings. The vulnerable regex uses nested quantifiers and alternation patterns that cause catastrophic backtracking, allowing an attacker to send a single malicious HTTP request containing a crafted email string to trigger excessive CPU consumption and denial of service. No authentication is required; the attack is network-accessible to any user who can send validation requests to an affected API endpoint. The vulnerability affects Zod versions up to 3.22.2 and express-zod-api versions before 10.0.0-beta1. Patches are available in Zod 3.22.3 and express-zod-api 10.0.0.

Affected products

Colinhacks Zod up to 3.22.2
RobinTail express-zod-api below 10.0.0-beta1

Timeline

2023-10-04: disclosed
2023-10-04: patched: Zod 3.22.3 and express-zod-api 10.0.0-beta1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.