Regular expression denial of service in jquery-validation
Priority LOW 39CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.
Why it matters now
EPSS 0.03575 89th percentileScored 2026-11-07
Fix Fixed jquery-validation (jquery-validation): 1.19.3jquery-validation (npm): 1.19.3+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jquery-validation | jquery-validation | before 1.19.3 | 1.19.3 | Patch available | CNA |
| — | jquery-validation (npm) | before 1.19.3 | 1.19.3 | Patch available | GHSA-jxwx-85vp-gvwm |
| — | jQuery.Validation (NuGet) | before 1.19.3 | 1.19.3 | Patch available | GHSA-jxwx-85vp-gvwm |
- jquery-validation Vendorjquery-validation Affected before 1.19.3 Fixed in 1.19.3 Patch available CNA
- jquery-validation (npm) Vendor— Affected before 1.19.3 Fixed in 1.19.3 Patch available GHSA-jxwx-85vp-gvwm
- jQuery.Validation (NuGet) Vendor— Affected before 1.19.3 Fixed in 1.19.3 Patch available GHSA-jxwx-85vp-gvwm
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jqueryvalidation:jquery_validation:*:*:*:*:*:node.js:*:* | before 1.19.3 | Vulnerable | jquery-validation |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:jqueryvalidation:jquery_validation:*:*:*:*:*:node.js:*:* Versions before 1.19.3 Vulnerable ·jquery-validation
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA jquery-validation (jquery-validation) Fixed in 1.19.3
- Fix · GHSA-jxwx-85vp-gvwm jquery-validation (npm) Fixed in 1.19.3 Advisory →
- Fix · GHSA-jxwx-85vp-gvwm jQuery.Validation (NuGet) Fixed in 1.19.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat Decision Manager 7
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21252
- 2026-10-03 Alias added: GHSA-jxwx-85vp-gvwm
References
Patch 2
Advisory 5
- https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm
- https://www.npmjs.com/package/jquery-validation
- https://security.netapp.com/advisory/ntap-20210219-0005/
- https://nvd.nist.gov/vuln/detail/CVE-2021-21252
- https://securitylab.github.com/advisories/GHSL-2020-294-redos-jquery-validation
Other 5
More jquery-validation Jquery Validation vulnerabilities
- TI-2022-13190 jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306 CVSS 3.1HIGH 7.5
- TI-2021-19299 Exponential ReDoS in jquery-validation CVSS 3.1HIGH 7.5
Sources
- CVE-2021-21252 · CVE Program
- CVE-2021-21252 · NVD
- FIRST EPSS
- GHSA-jxwx-85vp-gvwm · GitHub Advisory Database · CC BY 4.0
- CVE-2021-21252 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences