Packages / validator / Security

HighVulnerabilityGHSA-f5w6-r7rg-mcgqCVE-2014-8882Published 31 Aug 2020

Regular Expression Denial of Service in validator

Your version

Affected releases · validator

  • 3.x3.0.0 – 3.22.0Fixed in 3.22.1
  • 2.x and older0.1.0 – 2.1.0No fix, no longer updated

On 3.x, the newest line:

npm install validator@3.22.1
Every release on a timeline
13.x

  1. Not affected

    13.0.0 – 13.15.35

    19 releases, latest

3.x

  1. Affected

    3.0.0 – 3.22.0

    33 releases

  2. Fixed

    3.22.1 – 3.43.0

    26 releases

2.x

  1. Affected

    2.0.0 – 2.1.0

    2 releases

1.x

  1. Affected

    1.0.0 – 1.5.1

    12 releases

0.x

  1. Affected

    0.1.0 – 0.5.0

    57 releases

215 stable releases of validator, oldest to newest, one row per major.

What happens

Versions of validator prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the isURL method.

Recommendation

Update to version 3.22.1 or later.