v8n vulnerable to Inefficient Regular Expression Complexity

高 7.5CVE-2022-35923 · GHSA-xrx9-gj26-5wx9 · 02/08/2022 公開 · 17/06/2026 更新

要点

CVE-2022-35923 は v8n (v8n project), v8n に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.8%（全脆弱性の 78.2% より高い）。
対処：1.5.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
v8n v8n_project	`< 1.5.1`	`1.5.1`
v8n npm	`< 1.5.1`	`1.5.1`

概要

Impact

Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().

Patches

v1.5.1

References

huntr.dev report Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking

For more information

If you have any questions or comments about this advisory:

Open an issue in v8n issues list
Email us at [email protected]

NVD の説明

v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.