Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can cause the regex engine to consume excessive CPU time (minutes), leading to a Denial of Service (DoS) for the application. This issue has been patched in version 1.2.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 26 Nov 2025 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can cause the regex engine to consume excessive CPU time (minutes), leading to a Denial of Service (DoS) for the application. This issue has been patched in version 1.2.0. | |
| Title | Valibot has a ReDoS vulnerability in `EMOJI_REGEX` | |
| Weaknesses | CWE-1333 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-11-26T01:49:38.276Z
Reserved: 2025-11-21T01:08:02.613Z
Link: CVE-2025-66020
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-26T02:15:49.540
Modified: 2025-11-26T02:15:49.540
Link: CVE-2025-66020
Redhat
No data.
OpenCVE Enrichment
No data.