Regular Expression Denial of Service (ReDoS)

How it was found

The issue was already fixed.

Module: is-my-json-valid

Summary: Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. It used a regular expression (/^\S+@\S+$/) in order to validate emails. This can cause an impact of about 10 seconds matching time for data 90K characters long.

Description: Regex: formats.js exports[‘email’] = /^\S+@\S+$/ (introduced in 2014, 34a1a706)

Supporting Material/References:

• https://github.com/mafintosh/is-my-json-valid/pull/159
• https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976

Impact

Denial of service through blocking the event loop.