Loading HuntDB...

[is-my-json-valid] ReDoS via 'style' format

High
N
Node.js third-party modules
Submitted None
Reported by chalker

Vulnerability Details

Technical details and impact analysis

Uncontrolled Resource Consumption
I would like to report a ReDoS in `is-my-json-valid` It allows cause a denial of service if schema uses the built-in `style` format. # Module **module name:** `is-my-json-valid` **version:** 2.20.1 **npm page:** `https://www.npmjs.com/package/is-my-json-valid` ## Module Description > A JSONSchema validator that uses code generation to be extremely fast. ## Module Stats 1 250 253 weekly downloads # Vulnerability ## Vulnerability Description Classic ReDoS, polynomial time. Note that https://www.npmjs.com/package/safe-regex is not free from false positives/negatives (as noted in its Readme) and does not catch this and other polynomial regexps (e.g. `/a*a*b/`). ## Steps To Reproduce: ```js const imjv = require('is-my-json-valid') const validate = imjv({ maxLength: 100, format: 'style' }) console.log(validate(' '.repeat(1e4))) ``` # Wrap up - I contacted the maintainer to let them know: N - I opened an issue in the related repository: N ## Impact DoS if schema uses the `style` format.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Uncontrolled Resource Consumption