CVE-2025-26042: Uptime Kuma ReDoS Vulnerability in Notification Creation
Summary
CVE-2025-26042: Duplicate Advisory: Uptime Kuma ReDoS vulnerability. Affects uptime-kuma versions >= 1.23.0, <= 2.0.0-dev.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Uptime Kuma is an open-source self-hosted status monitoring solution that allows users to monitor the uptime of various services. It provides a user-friendly web interface for administrators to set up notifications and alerts for service outages. However, versions 1.23.0 and above are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when creating notifications, which can lead to performance degradation and service unavailability.
Vulnerability Detail
The vulnerability arises from the use of a poorly constructed regular expression in the notification creation process. When an administrator inputs a specially crafted string, it triggers catastrophic backtracking in the regex engine, leading to excessive CPU usage and potential denial of service. This can be exploited by an attacker to disrupt the service by overwhelming the server with requests that exploit this regex flaw.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can validate and sanitize input strings before they are processed by the notification creation function to prevent the exploitation of the regex vulnerability. This can be done by implementing a simple check to limit the length and character set of the input strings.
Conclusion
The ReDoS vulnerability in Uptime Kuma versions 1.23.0 to 2.0.0-dev.0 poses a significant risk to service availability. It is crucial to update to the latest version to ensure the security and stability of your monitoring solution. Implementing input validation can serve as a temporary workaround while you prepare for the update.
See every vulnerability recorded for uptime-kuma →
FAQ
A ReDoS (Regular Expression Denial of Service) vulnerability occurs when a regular expression takes an excessive amount of time to evaluate, leading to performance issues or service outages.
If you are using Uptime Kuma version 1.23.0 or later, your installation is vulnerable to this issue. You can check your version by running 'npm list uptime-kuma' in your terminal.
The primary impact is a denial of service, where the application may become unresponsive due to high CPU usage caused by the regex processing. This can affect the availability of your monitoring services.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground.
If an immediate update is not possible, implement input validation and sanitization as a temporary measure to mitigate the risk of exploitation until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for uptime-kuma.
