Regular Expression Denial of Service in jquery-validation

Description

The GitHub Security Lab team has identified potential security vulnerabilities in jquery.validation.

The project contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service)

This issue was discovered and reported by GitHub team member @erik-krogh (Erik Krogh Kristensen).

Recommendation

Update the jquery-validation package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.19.3
• Patched version(s): 1.19.3

References

• GHSA-jxwx-85vp-gvwm
• www.npmjs.com
• security.netapp.com
• jqueryvalidation.org
• www.nuget.org
• lists.debian.org
• CVE-2021-21252
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular expression denial of service in jquery-validation (GHSA-j9m2-h2pv-wvph) - CVE-2021-43306
• jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method - CVE-2022-31147
• html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346
• MooTools Regular Expression Denial of Service - CVE-2021-32821

Tags:

npm

jquery-validation