vulnwire
7.5high

CVE-2016-2537

Regular Expression Denial of Service in is-my-json-valid

Also known as GHSA-f522-ffg8-j8r6

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 79%
Public exploits
0
none known

The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.

Exploit prediction (EPSS)

1.85% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

EcosystemPackageAffectedFixed in
npmis-my-json-valid
<2.12.4
2.12.4

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-1333 Inefficient Regular Expression Complexity

References

  • nodesecurity.io /advisories/76 · x_refsource_CONFIRM, x_transferred
  • github.com /mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-2537 · advisory
  • github.com /github/advisory-database/pull/4850 · web
  • github.com /mafintosh/is-my-json-valid/pull/159 · web
  • github.com /mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976 · web
  • hackerone.com /reports/317548 · web
  • github.com /advisories/GHSA-f522-ffg8-j8r6 · advisory
  • github.com /mafintosh/is-my-json-valid · package
  • npmjs.com /advisories/572 · web
  • npmjs.com /advisories/76 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.