v8n vulnerable to Inefficient Regular Expression Complexity

CAO 7.5CVE-2022-35923 · GHSA-xrx9-gj26-5wx9 · Công bố 02/08/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-35923 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng v8n (v8n project), v8n.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.8%, cao hơn 78.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.5.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
v8n v8n_project	`< 1.5.1`	`1.5.1`
v8n npm	`< 1.5.1`	`1.5.1`

Mô tả

Impact

Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().

Patches

v1.5.1

References

huntr.dev report Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking

For more information

If you have any questions or comments about this advisory:

Open an issue in v8n issues list
Email us at [email protected]

Mô tả của NVD

v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.