Regular Expression Denial of Service in is-my-json-valid

ÉLEVÉE 7.5CVE-2016-2537 · GHSA-f522-ffg8-j8r6 · Published 23/02/2016 · updated 17/06/2026

En bref

CVE-2016-2537 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant is my json valid (is my json valid project), is-my-json-valid.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.8%, plus élevée que 79.2% des vulnérabilités.
Correctif : mettre à jour vers 2.12.4 ou plus récent.

Package	Affected versions	Patched versions
is my json valid is_my_json_valid_project	`≤ 2.12.3`	No fix yet
is-my-json-valid npm	`< 2.12.4`	`2.12.4`

Description

Version of is-my-json-valid before 2.12.4 are vulnerable to regular expression denial of service (ReDoS) via the email validation function.

Recommendation

Update to version 2.12.4 or later.

NVD description

The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.

References

nvd.nist.gov/vuln/detail/CVE-2016-2537 · ADVISORY
github/advisory-database#4850 · WEB
mafintosh/is-my-json-valid#159 · WEB
mafintosh/is-my-json-valid commit b3051b2 · WEB
mafintosh/is-my-json-valid commit eca4beb · WEB
hackerone.com/reports/317548 · WEB
GitHub Advisory GHSA-f522-ffg8-j8r6 · ADVISORY
mafintosh/is-my-json-valid · PACKAGE
npmjs.com/advisories/572 · WEB
npmjs.com/advisories/76 · WEB
nodesecurity.io/advisories/76

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free