Every CVE Search/ Get API key

CVE-2022-31147

jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306

7.5 HighPublic exploitFix available

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.24%Up 1.4 points since Jul 15, 2022
90%50%10%1%

What each source reports

CVE List Score used 7.5

jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.

Record
CVE-2022-31147
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
EUVDEUVD-2022-6329 7.5

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.

Record
EUVD-2022-6329
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-ffmh-x56j-9rc3 7.5

jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method

Summary

Incomplete fix of CVE-2021-43306: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method.

Record
GHSA-ffmh-x56j-9rc3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
NVD 7.5

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.

Record
CVE-2022-31147
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSV 7.5

jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.

Record
CVE-2022-31147
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVGHSA-ffmh-x56j-9rc3 7.5

jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method

Summary

Incomplete fix of CVE-2021-43306: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method.

Record
GHSA-ffmh-x56j-9rc3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVUBUNTU-CVE-2022-31147 7.5

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.

Record
UBUNTU-CVE-2022-31147
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1773101704 No score

TuxCare security update for jquery-validation (4 CVEs)

TuxCare rebuilt jquery-validation to address 4 CVEs. Fixed in 1.19.0-tuxcare.1.

Record
CLSA-2026-1773101704
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jquery-validation
npm
 before 1.19.5
1.19.5
jquery-validation
TuxCare:npm
From an advisory covering 4 CVEs
 1.19.0-tuxcare.0 up to 1.19.0-tuxcare.1, plus listed versions
1.19.0
1.19.0-tuxcare.1
civicrm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.7.1+dfsg-14.7.1+dfsg-24.7.1+dfsg-2ubuntu14.7.1+dfsg-2ubuntu1+esm1
 None known
civicrm
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.7.23+dfsg-1ubuntu14.7.24+dfsg-1ubuntu14.7.30+dfsg-1ubuntu14.7.30+dfsg-1ubuntu1+esm1
 None known
civicrm
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.11.0+dfsg-15.18.1+dfsg-15.20.3+dfsg-15.21.0+dfsg-15.21.1+dfsg-15.21.2+dfsg-15.21.2+dfsg-1ubuntu0.1~esm1
 None known
civicrm
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.33.2+dfsg1-15.33.2+dfsg1-1build15.33.2+dfsg1-1ubuntu15.33.2+dfsg1-1ubuntu1+esm1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubamhar-hckr/Webapp_Pentast2025-09-02

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31147 is a high vulnerability (CVSS 7.5) in Jquery-validation, published July 5, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.24%, the 82nd percentile. Fixed in jquery-validation 1.19.5.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open