CVE-2016-2537: Regular Expression Denial of Service in is-my-json-valid
Summary
CVE-2016-2537: Regular Expression Denial of Service in is-my-json-valid. Affects is-my-json-valid versions < 2.17.2. Fixed in 2.17.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
is-my-json-valid is an npm package used for JSON schema validation. It provides a simple and efficient way to validate JSON data against a specified schema. However, versions before 1.4.1 or 2.17.2 are vulnerable to a regular expression denial of service (ReDoS) attack when validating email addresses.
Vulnerability Detail
The vulnerability in is-my-json-valid arises from the email validation function. An attacker can exploit this vulnerability by providing a specially crafted email address that triggers a ReDoS attack. This can lead to a denial of service condition where the application becomes unresponsive or crashes due to excessive CPU usage. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
2.17.2
This is the first release that contains the fix.
npm install is-my-json-valid@2.17.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to update to the latest secure version of is-my-json-valid.
Conclusion
The vulnerability in is-my-json-valid can be mitigated by updating to a secure version of the package. It is recommended to update to version 1.4.1, 2.17.2, or any later version to prevent the risk of a regular expression denial of service attack. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for is-my-json-valid →
FAQ
is-my-json-valid is an npm package used for JSON schema validation. It allows developers to validate JSON data against a specified schema.
A ReDoS attack is a type of denial of service attack where an attacker provides input that causes a regular expression to take an excessive amount of time to process. This can lead to a denial of service condition where the application becomes unresponsive or crashes.
The impact of this vulnerability is a denial of service condition. An attacker can exploit the vulnerability to cause the application to become unresponsive or crash due to excessive CPU usage.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
To fix this vulnerability, update to version 1.4.1, 2.17.2, or any later version of is-my-json-valid.
References
Related vulnerabilities
Recent vulnerabilities recorded for is-my-json-valid.
