Regular Expression Denial of Service in is-my-json-valid

HOCH 7.5CVE-2016-2537 · GHSA-f522-ffg8-j8r6 · Published 23/02/2016 · updated 17/06/2026

Kurz gesagt

CVE-2016-2537 ist eine Schwachstelle (HOCH (CVSS 7.5)) in is my json valid (is my json valid project), is-my-json-valid.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.8%, höher als bei 79.2% aller Schwachstellen.
Abhilfe: auf 2.12.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
is my json valid is_my_json_valid_project	`≤ 2.12.3`	No fix yet
is-my-json-valid npm	`< 2.12.4`	`2.12.4`

Description

Version of is-my-json-valid before 2.12.4 are vulnerable to regular expression denial of service (ReDoS) via the email validation function.

Recommendation

Update to version 2.12.4 or later.

NVD description

The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.

References

nvd.nist.gov/vuln/detail/CVE-2016-2537 · ADVISORY
github/advisory-database#4850 · WEB
mafintosh/is-my-json-valid#159 · WEB
mafintosh/is-my-json-valid commit b3051b2 · WEB
mafintosh/is-my-json-valid commit eca4beb · WEB
hackerone.com/reports/317548 · WEB
GitHub Advisory GHSA-f522-ffg8-j8r6 · ADVISORY
mafintosh/is-my-json-valid · PACKAGE
npmjs.com/advisories/572 · WEB
npmjs.com/advisories/76 · WEB
nodesecurity.io/advisories/76

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free