---
title: "GHSA-f5w6-r7rg-mcgq: Regular Expression Denial of Service in validator"
description: "High severity. Regular Expression Denial of Service in validator. Affects validator; fixed in 3.22.1."
url: https://inlinr.com/advisories/GHSA-f5w6-r7rg-mcgq
lang: en
---

[Packages](https://inlinr.com/packages) / [validator](https://inlinr.com/packages/validator) / [Security](https://inlinr.com/packages/validator/security)

High Vulnerability GHSA-f5w6-r7rg-mcgq CVE-2014-8882 Published 31 Aug 2020

# Regular Expression Denial of Service in validator

Your version 

Affected releases · [validator](https://inlinr.com/packages/validator)

- 3.x 3.0.0 – 3.22.0 Fixed in 3.22.1
- 2.x and older 0.1.0 – 2.1.0 No fix, no longer updated

On 3.x, the newest line:

```
npm install validator@3.22.1
```

Every release on a timeline

13.x 

1. Not affected

13.0.0 – 13.15.35  
19 releases, latest

3.x 

1. Affected

3.0.0 – 3.22.0  
33 releases
2. Fixed

3.22.1 – 3.43.0  
26 releases

2.x 

1. Affected

2.0.0 – 2.1.0  
2 releases

1.x 

1. Affected

1.0.0 – 1.5.1  
12 releases

0.x 

1. Affected

0.1.0 – 0.5.0  
57 releases

215 stable releases of validator, oldest to newest, one row per major.

## What happens

Versions of `validator` prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the `isURL` method.

Recommendation

Update to version 3.22.1 or later.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-8882 "https://nvd.nist.gov/vuln/detail/CVE-2014-8882")  
nvd.nist.gov/vuln/detail/CVE-2014-8882
- [Issue](https://github.com/chriso/validator.js/issues/152#issuecomment-48107184 "https://github.com/chriso/validator.js/issues/152#issuecomment-48107184")  
#152
- [Package](https://github.com/chriso/validator.js "https://github.com/chriso/validator.js")  
github.com/chriso/validator.js
- [Reference](https://snyk.io/vuln/npm:validator:20130705 "https://snyk.io/vuln/npm:validator:20130705")  
snyk.io/vuln/npm:validator:20130705
- [Reference](https://www.npmjs.com/advisories/42 "https://www.npmjs.com/advisories/42")  
npmjs.com/advisories/42