CVE-2021-3794: Inefficient Regular Expression Complexity in vuelidate
Summary
CVE-2021-3794: Inefficient Regular Expression Complexity in vuelidate. Affects @vuelidate/validators versions < 2.0.0-alpha.22. Fixed in 2.0.0-alpha.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vuelidate is a simple, lightweight model-based validation library for Vue.js 2.x & 3.0. It provides an easy way to validate form inputs and enforce data integrity. The library includes various validators that can be used to validate different types of data, such as strings, numbers, and URLs. However, a vulnerability has been discovered in the @vuelidate/validators package, which can lead to a denial of service (DoS) attack. This vulnerability allows an attacker to provide crafted input to the url(input) function, causing the application to consume an excessive amount of CPU.
Vulnerability Detail
The vulnerability in @vuelidate/validators is due to inefficient regular expression complexity. When the url(input) function is called with a specially crafted input, the regular expression used for URL validation can exhibit exponential time complexity. This can be exploited by an attacker to cause a DoS attack, as the application will spend an excessive amount of time validating the input. The impact of this vulnerability is a significant increase in CPU usage, which can lead to degraded performance or even a complete system freeze.
How To Fix
Minimum fixed version
2.0.0-alpha.22
This is the first release that contains the fix.
npm install @vuelidate/validators@2.0.0-alpha.22Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the @vuelidate/validators package to the latest version as soon as possible.
Conclusion
The @vuelidate/validators package is vulnerable to an inefficient regular expression complexity issue, which can be exploited to cause a denial of service attack. To mitigate this vulnerability, it is crucial to update the package to version 2.0.0-alpha.22 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @vuelidate/validators →
FAQ
vuelidate is a validation library for Vue.js that provides an easy way to validate form inputs and enforce data integrity.
The vulnerability allows an attacker to cause a denial of service (DoS) attack by consuming excessive CPU resources.
To fix this vulnerability, update the @vuelidate/validators package to version 2.0.0-alpha.22 or later.
There is no known workaround for this vulnerability. It is recommended to update the package to the latest version.
For more information about this vulnerability, you can refer to the GitHub Advisory Database or contact the package maintainers.
