GHSA-vvf2-ppj9-pp49

Inefficient Regular Expression Complexity in vuelidate

Source: GitHub Advisory Database (reviewed) High CVE-2021-3794

Packages

Ecosystem	Package	Affected	Fixed in
npm	@vuelidate/validators	< 2.0.0-alpha.22	2.0.0-alpha.22

Details

As written in the advisory (Markdown source, shown as plain text).

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the `@vuelidate/validators` package. An attacker that is able to provide crafted input to the url(input) function may cause an application to consume an excessive amount of CPU.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3794 advisory
https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d web
https://github.com/vuelidate/vuelidate package
https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7 web