Description
is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to loop “forever.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.9.0
References
Could your website be exposed too?
SmartScanner can check your website for is_js vulnerable to Regular Expression Denial of Service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex - CVE-2020-28469
- insane vulnerable to Regular Expression Denial of Service - CVE-2020-26303
- Knwl.js Regular Expression Denial of Service vulnerability - CVE-2020-26306
- Regular Expression Denial of Service (ReDoS) in lodash - lodash-es - CVE-2020-28500
You might also like:
See something that needs correcting? Let us knowUpdated July 06, 2023