@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-1333.
Summary
## Summary The `HTMLInputElement.checkValidity()` method constructed a `RegExp` directly from the user-controlled `pattern` property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop. ## Fix Fixed in commit https://github.com/asymmetric-effort/NogginLessDom/commit/25a3cbac665fae5663f8b71c073b80c3152dbe7b on `main`. Added: - Pattern length limit (1024 characters) - Nested quantifier detection (`hasNestedQuantifiers`) that rejects patterns like `(a+)+` before constructing the regex - Patterns exceeding limits are treated as non-matching (safe default)
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | @asymmetric-effort/nogginlessdom (npm) | before 0.0.22 | 0.0.22 | Patch available | GHSA-x4hg-hfwf-p9mw |
- @asymmetric-effort/nogginlessdom (npm) Vendor— Affected before 0.0.22 Fixed in 0.0.22 Patch available GHSA-x4hg-hfwf-p9mw
Remediation
- Fix · GHSA-x4hg-hfwf-p9mw @asymmetric-effort/nogginlessdom (npm) Fixed in 0.0.22 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-x4hg-hfwf-p9mw
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences