jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method

高危 7.5CVE-2022-31147 · GHSA-ffmh-x56j-9rc3 · Published 14/07/2022 · updated 17/06/2026

要点

CVE-2022-31147 是影响 jquery validation (jqueryvalidation), jquery-validation 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：2.2%，高于 82.9% 的漏洞。
修复：升级到 1.19.5 或更高版本。

Package	Affected versions	Patched versions
jquery validation jqueryvalidation	`< 1.19.5`	`1.19.5`
jquery-validation npm	`< 1.19.5`	`1.19.5`

Description

Summary

Incomplete fix of CVE-2021-43306: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method.

NVD description

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.

References

jquery-validation/jquery-validation security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-31147 · ADVISORY
jquery-validation/jquery-validation commit 5bbd80d · WEB
jquery-validation/jquery-validation · PACKAGE
jquery-validation/jquery-validation release 1.19.5 · WEB

jquery validation 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

jquery validation

jqueryvalidation

< 1.19.5

1.19.5

jquery-validation

npm

< 1.19.5

1.19.5

Description

Summary

NVD description

jquery validation 的其他漏洞

查看全部 →