GitHub Advisoryadvisory · npm

GHSA-vvf2-ppj9-pp49 Inefficient Regular Expression Complexity in vuelidate

HIGH Published 2021-09-20 Modified 2022-05-04 Official page ↗
Aliases
CVE-2021-3794
Ecosystem
npm
Packages
@vuelidate/validators
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400, CWE-697
Reviewed
2021-09-16

Affected packages

• npm @vuelidate/validators: < 2.0.0-alpha.22 → fixed in 2.0.0-alpha.22

Description

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the `@vuelidate/validators` package. An attacker that is able to provide crafted input to the url(input) function may cause an application to consume an excessive amount of CPU.

Related

Alias · CVE (1)

  • CVE-2021-3794 vuelidate is vulnerable to Inefficient Regular Expression Complexity vulnerability

Weakness · CWE (3)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-697 Incorrect Comparison weakness

References