High Severity Regular Expression Denial of Service in Joi Package
Summary
GHSA-mrx9-2rrp-rhpx: Duplicate Advisory: joi: Quadratic regular-expression backtracking in Joi.string().isoDate(). Affects joi versions >= 18.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Joi is a popular validation library for JavaScript, primarily used in Node.js applications. It provides a powerful and flexible way to validate data structures, ensuring that inputs conform to specified formats. The library is widely utilized in frameworks like hapi.js, making it a critical component for many web applications. However, certain versions of Joi are vulnerable to a specific denial of service attack due to inefficient regular expression handling.
Vulnerability Detail
The vulnerability arises from a quadratic regular-expression backtracking issue in the Joi.string().isoDate() validation rule. This flaw allows an attacker to craft an input that, while appearing valid, causes the regex engine to perform excessive backtracking. As a result, the application can experience significant delays, potentially stalling or crashing under certain conditions. The affected versions of Joi are those between 17.2.0 and 17.13.7, as well as between 18.0.0 and 18.2.6.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the length of the input string before it reaches Joi for validation. For example, you can implement a check in your code like this: if (inputString.length > 1000) { throw new
Error('Input too long');
} This will prevent excessively long strings from being processed by the Joi validation.
Conclusion
In summary, the Joi package has a high-severity vulnerability related to regular expression denial of service, affecting specific versions. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, implementing input length checks can serve as a temporary workaround while transitioning to the fixed versions.
See every vulnerability recorded for joi →
FAQ
The affected versions are Joi versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
An attacker can exploit this vulnerability to stall the application, leading to denial of service and potential downtime.
Yes, the permanent fix is to update to the patched versions of Joi: 17.13.7 or 18.2.6.
Related vulnerabilities
Recent vulnerabilities recorded for joi.
