TI-2021-22741 Aliases GHSA-xx4c-jj58-r7x6

Inefficient Regular Expression Complexity in Validator.js

LOW 38CWE-1333Published 2021-11-19 · Updated 2022-07-12

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: Denial of service
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-1333.

Summary

### Impact Versions of `validator` prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the `rtrim` and `trim` sanitizers. ### Patches The problem has been patched in validator 13.7.0

Why it matters now

Fix Fixed validator (npm): 13.7.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	validator (npm)	11.1.0 to before 13.7.0	13.7.0	Patch available	GHSA-xx4c-jj58-r7x6

validator (npm) Vendor— Affected 11.1.0 to before 13.7.0 Fixed in 13.7.0 Patch available GHSA-xx4c-jj58-r7x6

Remediation

Fix · GHSA-xx4c-jj58-r7x6 validator (npm) Fixed in 13.7.0 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-xx4c-jj58-r7x6

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-3765

Other 5

Sources

GHSA-xx4c-jj58-r7x6 · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences