GitHub Advisoryadvisory · npm

GHSA-3phv-83cj-p8p7 nope-validator Regular Expression Denial of Service vulnerability

MEDIUM Published 2024-10-26 Modified 2024-10-28 Official page ↗
Aliases
CVE-2020-26309
Ecosystem
npm
Packages
nope-validator
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
Weaknesses
CWE-1333
Reviewed
2024-10-28

Affected packages

• npm nope-validator: < 0.12.1 → fixed in 0.12.1

Description

Nope is a JavaScript validator. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). This vulnerability is fixed in 0.12.1.

Related

Alias · CVE (1)

  • CVE-2020-26309 Validate.js provides a declarative way of validating javascript objects. vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References