Exponential ReDoS in jquery-validation
Priority LOW 36CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-1333.
Summary
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
Why it matters now
EPSS 0.01523 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed jquery-validation (jquery-validation): 1.19.4jquery-validation (npm): 1.19.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jquery-validation | jquery-validation | before 1.19.4 | 1.19.4 | Patch available | CNA |
| — | jquery-validation (npm) | before 1.19.4 | 1.19.4 | Patch available | GHSA-j9m2-h2pv-wvph |
- jquery-validation Vendorjquery-validation Affected before 1.19.4 Fixed in 1.19.4 Patch available CNA
- jquery-validation (npm) Vendor— Affected before 1.19.4 Fixed in 1.19.4 Patch available GHSA-j9m2-h2pv-wvph
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jqueryvalidation:jquery_validation:*:*:*:*:*:node.js:*:* | before 1.19.4 | Vulnerable | jquery-validation |
- cpe:2.3:a:jqueryvalidation:jquery_validation:*:*:*:*:*:node.js:*:* Versions before 1.19.4 Vulnerable ·jquery-validation
Remediation
- Fix · CNA jquery-validation (jquery-validation) Fixed in 1.19.4
- Fix · GHSA-j9m2-h2pv-wvph jquery-validation (npm) Fixed in 1.19.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43306
- 2026-10-03 Alias added: GHSA-j9m2-h2pv-wvph
References
Other 4
More jquery-validation Jquery Validation vulnerabilities
- TI-2022-13190 jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306 CVSS 3.1HIGH 7.5
- TI-2021-04355 Regular expression denial of service in jquery-validation CVSS 3.1HIGH 7.5
Sources
- CVE-2021-43306 · CVE Program
- CVE-2021-43306 · NVD
- FIRST EPSS
- GHSA-j9m2-h2pv-wvph · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences