is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to loop “forever." This vulnerability was found using a CodeQL query which identifies inefficient regular expressions. is.js has no patch for this issue.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-12-23T23:03:51.372448Z

Updated: 2024-09-17T00:26:49.755Z

Reserved: 2020-10-01T00:00:00

Link: CVE-2020-26302

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-12-22T21:15:08.877

Modified: 2024-11-21T05:19:48.677

Link: CVE-2020-26302

cve-icon Redhat

No data.