CVE-2020-1920: Regular Expression Denial of Service in react-native
Summary
Your scan reports react-native 0.63.4. Fixed in 0.64.1.
CVE-2020-1920: Regular expression denial of service in react-native. Affects react-native across 2 version ranges.
>= 0.59.0, < 0.62.3
>= 0.63.0, < 0.64.1
Fixed in 0.64.1. How to fix ↓
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
React Native is an open-source framework for building mobile applications using JavaScript and React. It allows developers to write code once and deploy it on multiple platforms. The react-native package is a core component of React Native, providing essential functionality and APIs for building mobile apps. Unfortunately, react-native versions 0.59.0 to 0.62.3 and 0.63.0 to 0.64.1 are vulnerable to a regular expression denial of service (ReDoS) attack.
Vulnerability Detail
The vulnerability exists in the validateBaseUrl function of react-native. An attacker can exploit this vulnerability by providing a specially crafted input that triggers a ReDoS attack. This can cause the application to consume excessive resources, become unresponsive, or even crash. The vulnerability was introduced in react-native version 0.59.0 and was fixed in version 0.64.1. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2020-1920. The vulnerability has a CVSS v3 score of 7.5, indicating a high severity.
How To Fix
Latest published version: 0.88.0 as of 22 Oct 2026
npm install react-native@0.88.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.64.1
This is the first release that contains the fix.
npm install react-native@0.64.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to sanitize and validate user input before passing it to the validateBaseUrl function. This can help mitigate the risk of a ReDoS attack. Here is an example of how input validation can be implemented in JavaScript:
function sanitizeInput(input) {
// Perform input validation and sanitization
// Return the sanitized input
}
const baseUrl = sanitizeInput(userInput);
validateBaseUrl(baseUrl);
Conclusion
In conclusion, react-native versions 0.59.0 to 0.62.3 and 0.63.0 to 0.64.1 are vulnerable to a regular expression denial of service (ReDoS) attack. This vulnerability can be exploited by providing specially crafted input to the validateBaseUrl function, leading to excessive resource consumption, unresponsiveness, or crashes. To mitigate this vulnerability, it is recommended to update to react-native version 0.64.1 or later. If immediate update is not possible, implementing input validation and sanitization can provide temporary protection. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for react-native →
FAQ
React Native is an open-source framework for building mobile applications using JavaScript and React. It allows developers to write code once and deploy it on multiple platforms.
A regular expression denial of service (ReDoS) attack is a type of security vulnerability that can cause a system to become unresponsive or crash by exploiting the way regular expressions are processed. By providing a specially crafted input, an attacker can trigger excessive backtracking in the regular expression engine, leading to a significant increase in processing time and resource consumption.
If your application uses a vulnerable version of react-native and is exposed to untrusted user input that is passed to the validateBaseUrl function, an attacker can exploit this vulnerability to cause your application to consume excessive resources, become unresponsive, or crash. This can lead to a degraded user experience, service disruption, or even a complete system failure.
To fix this vulnerability, you should update your react-native package to version 0.64.1 or later. This can be done by updating the package version in your package.json file and running the package manager's update command. For example, if you are using npm, you can run 'npm update react-native'. It is recommended to always use the latest stable version of react-native to ensure your application is protected against known vulnerabilities.
If updating to the latest version of react-native is not immediately feasible, you can implement input validation and sanitization before passing user input to the validateBaseUrl function. This can help mitigate the risk of a ReDoS attack. Refer to the 'workaround' section for an example of how to implement input validation in JavaScript.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.