CVE-2025-66020: Valibot ReDoS Vulnerability in EMOJI_REGEX
Summary
CVE-2025-66020: Valibot has a ReDoS vulnerability in EMOJI_REGEX. Affects valibot versions >= 0.31.0, < 1.2.0. Fixed in 1.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Valibot is a validation library for JavaScript that provides various validation functions, including emoji validation. It is widely used in applications that require user input validation to ensure data integrity and security. The library's emoji action utilizes a regular expression (EMOJI_REGEX) to validate emoji characters in user inputs. However, a vulnerability has been identified in this regex pattern, making it susceptible to Regular Expression Denial of Service (ReDoS) attacks.
Vulnerability Detail
The vulnerability arises from catastrophic backtracking in the EMOJI_REGEX due to overlapping character classes. Specifically, the regex pattern includes ambiguous classes like \p{Emoji_Presentation} and more specific classes such as [\u{1F1E6}-\u{1F1FF}]. When a crafted input string is provided that nearly matches the regex, the regex engine can enter an exponential number of backtracking paths, leading to excessive CPU consumption and potential Denial of Service (DoS) for applications using Valibot's emoji validation.
How To Fix
Minimum fixed version
1.2.0
This is the first release that contains the fix.
npm install valibot@1.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input length restrictions or filtering out potentially malicious input before passing it to the Valibot validation. However, the best approach is to update to the patched version as soon as possible.
Conclusion
The CVE-2025-66020 vulnerability in Valibot's EMOJI_REGEX poses a significant risk of Denial of Service due to regex backtracking issues. It is crucial for developers using Valibot to update to version 1.2.0 or later to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for valibot →
FAQ
A ReDoS (Regular Expression Denial of Service) attack exploits vulnerabilities in regex patterns, causing excessive CPU usage and potentially crashing the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your package-lock.json file with Vulert's playground at Vulert Scanner to see if your application is affected.
Symptoms include significant delays in processing user inputs that contain emojis, leading to potential application unresponsiveness or crashes.
While the primary risk is Denial of Service, it does not directly lead to data loss. However, prolonged downtime can affect user experience and data availability.
Implement input validation to restrict the length and content of user inputs, and prioritize updating to the patched version of Valibot as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for valibot.
