CVE-2026-58270: Sync-in Server Regex Denial of Service Vulnerability
Summary
CVE-2026-58270: Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff pathFilters. Affects @sync-in/server versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sync-in Server is an open-source application designed for synchronizing files across devices. It provides a robust API for managing sync operations, including diff generation for file changes. The server is built on Node.js and is widely used for its efficiency in handling file synchronization tasks. However, a vulnerability in version 2.3.0 allows attackers to exploit regex patterns, leading to potential denial of service.
Vulnerability Detail
The vulnerability arises from the sync diff endpoint, which accepts user-controlled regex patterns through the 'pathFilters' parameter. This regex is compiled without complexity validation, allowing for catastrophic backtracking. For instance, a regex pattern like '^(a+)+b' can cause the Node.js event loop to block when evaluated against certain file paths, rendering the server unresponsive. This can lead to denial of service, especially in single-process deployments, where other requests cannot be processed while the regex evaluation is ongoing.
How To Fix
Latest published version: 2.6.0 as of 23 Oct 2026
npm install @sync-in/server@2.6.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0
This is the first release that contains the fix.
npm install @sync-in/server@2.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can validate the 'pathFilters' input before using it in your application. Here is an example of how to implement this validation in your code:
@IsOptional()
@Transform(({ value }) => {
if (typeof value !== 'string' || value.length === 0) return null;
if (value.length > MAX_PATH_FILTER_PATTERN_LENGTH) {
throw new BadRequestException('Path filter pattern is too long');
}
let pathFilter: RegExp;
try {
pathFilter = new RegExp(value, 'i');
} catch {
throw new BadRequestException('Invalid path filter pattern');
}
if (!isSafePattern(pathFilter)) {
throw new BadRequestException('Unsafe path filter pattern');
}
return pathFilter;
})
pathFilters?: RegExp = null;
This code checks for valid input and rejects unsafe regex patterns.
Conclusion
The CVE-2026-58270 vulnerability in Sync-in Server poses a significant risk by allowing denial of service through unsanitized regex patterns. It is crucial to update to the patched version and implement proper input validation to mitigate this risk.
See every vulnerability recorded for @sync-in/server →
FAQ
CVE-2026-58270 is a vulnerability in Sync-in Server that allows for denial of service through unsanitized regex patterns.
An attacker can exploit this vulnerability by sending crafted regex patterns that block the server's event loop, making it unresponsive to other requests.
Sync-in Server versions up to 2.3.0 are affected. Version 2.4.0 and later contain the fix.
You can protect your application by updating to version 2.4.0 or later and implementing input validation for regex patterns.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can check for vulnerabilities without signup using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for @sync-in/server.
