Description
vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the @vuelidate/validators package. An attacker that is able to provide crafted input to the url(input) function may cause an application to consume an excessive amount of CPU.
Recommendation
Update the @vuelidate/validators package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.0.0-alpha.21
- Patched version(s): 2.0.0-alpha.22
References
Could your website be exposed too?
SmartScanner can check your website for Inefficient Regular Expression Complexity in vuelidate and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Inefficient Regular Expression Complexity in handsontable - CVE-2021-23446
- Inefficient Regular Expression Complexity in chalk/ansi-regex - CVE-2021-3807
- axios Inefficient Regular Expression Complexity vulnerability - CVE-2021-3749
- Inefficient Regular Expression Complexity in validator.js - CVE-2021-3765
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2023