GHSA-j9m2-h2pv-wvph

Regular expression denial of service in jquery-validation

Source: GitHub Advisory Database (reviewed) Low CVE-2021-43306

Packages

Ecosystem	Package	Affected	Fixed in
npm	jquery-validation	< 1.19.4	1.19.4

Details

As written in the advisory (Markdown source, shown as plain text).

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-43306 advisory
https://github.com/jquery-validation/jquery-validation/pull/2428 web
https://github.com/jquery-validation/jquery-validation/commit/69cb17ed774b427f7e2ffcdf197968231725c30e web
https://github.com/jquery-validation/jquery-validation package
https://research.jfrog.com/vulnerabilities/jquery-validation-redos-xray-211348 web