jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306
Priority MEDIUM 43CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.
Summary
The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0224 82nd percentileScored 2026-11-07
Fix Fixed jquery-validation (jquery-validation): 1.19.5jquery-validation (npm): 1.19.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jquery-validation | jquery-validation | before 1.19.5 | 1.19.5 | Patch available | CNA |
| — | jquery-validation (npm) | before 1.19.5 | 1.19.5 | Patch available | GHSA-ffmh-x56j-9rc3 |
- jquery-validation Vendorjquery-validation Affected before 1.19.5 Fixed in 1.19.5 Patch available CNA
- jquery-validation (npm) Vendor— Affected before 1.19.5 Fixed in 1.19.5 Patch available GHSA-ffmh-x56j-9rc3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jqueryvalidation:jquery_validation:*:*:*:*:*:node.js:*:* | before 1.19.5 | Vulnerable | jquery-validation |
- cpe:2.3:a:jqueryvalidation:jquery_validation:*:*:*:*:*:node.js:*:* Versions before 1.19.5 Vulnerable ·jquery-validation
Remediation
- Fix · CNA jquery-validation (jquery-validation) Fixed in 1.19.5
- Fix · GHSA-ffmh-x56j-9rc3 jquery-validation (npm) Fixed in 1.19.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31147
- 2026-10-03 Alias added: GHSA-ffmh-x56j-9rc3
References
Advisory 3
More jquery-validation Jquery Validation vulnerabilities
- TI-2021-04355 Regular expression denial of service in jquery-validation CVSS 3.1HIGH 7.5
- TI-2021-19299 Exponential ReDoS in jquery-validation CVSS 3.1HIGH 7.5
Sources
- CVE-2022-31147 · CVE Program
- CVE-2022-31147 · NVD
- FIRST EPSS
- GHSA-ffmh-x56j-9rc3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences