GHSA-3phv-83cj-p8p7

nope-validator Regular Expression Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-26309

Packages

Ecosystem	Package	Affected	Fixed in
npm	nope-validator	< 0.12.1	0.12.1

Details

As written in the advisory (Markdown source, shown as plain text).

Nope is a JavaScript validator. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). This vulnerability is fixed in 0.12.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-26309 advisory
https://github.com/ftonato/nope-validator/issues/352 web
https://github.com/ftonato/nope-validator/commit/4564b7444dcd92769e5c5b80420469c9f18b7a05#diff-9c399c46fa266bcf2be2704fbb369181726959e148e95… web
https://github.com/ftonato/nope-validator/commit/c8af9f93abe8f4786f8f69d2b0518f8ca3652f44 web
https://github.com/ftonato/nope-validator package
https://securitylab.github.com/advisories/GHSL-2020-303-redos-nope-validator advisory