{"id":"CVE-2022-35923","aliases":["EUVD-2022-7187","GHSA-xrx9-gj26-5wx9"],"status":"published","title":"Inefficient Regular Expression Complexity in v8n","description":"v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01763,"percentile":0.78202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2022-08-02T20:10:11Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"npm","package":"v8n","fixed_in":["1.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"v8n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"v8n","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.1"}]}]}],"products":[{"vendor":"imbrn","product":"v8n"},{"vendor":"v8n_project","product":"v8n"}],"references":[{"url":"https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35923","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xrx9-gj26-5wx9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35923.json","tags":["advisory"]},{"url":"https://github.com/imbrn/v8n","tags":["package"]},{"url":"https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-35923","title":"Inefficient Regular Expression Complexity in v8n","description":"v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-02T20:10:11Z","modified":"2025-04-22T17:45:31.262Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-7187","description":"v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-02T20:10:11Z","modified":"2025-04-22T17:45:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:15.540112Z"}],"ghsa":[{"id":"GHSA-xrx9-gj26-5wx9","title":"v8n vulnerable to Inefficient Regular Expression Complexity","description":"### Impact\nInefficient regular expression complexity of `lowercase()` and `uppercase()` regex could lead to a denial of service attack. With a formed payload `'a' + 'a'.repeat(i) + 'A'`, only 32 characters payload could take 29443 ms time execution when testing `lowercase()`. The same issue happens with `uppercase()`.\n\n### Patches\nv1.5.1\n\n### References\n[huntr.dev report](https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609)\n[_Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking_](https://snyk.io/blog/redos-and-catastrophic-backtracking/)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [v8n issues list](https://github.com/imbrn/v8n)\n* Email us at [brunodev02221@gmail.com](mailto:brunodev02221@gmail.com)\n","status":"published","published":"2022-10-07T07:33:44Z","modified":"2023-07-31T20:43:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:36:58.760727Z"}],"nvd":[{"id":"CVE-2022-35923","description":"v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-02T20:15:09.947Z","modified":"2026-06-17T04:52:31.823Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"CVE-2022-35923","title":"Inefficient Regular Expression Complexity in v8n","description":"v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-02T20:10:11Z","modified":"2026-10-28T02:30:38.59181341Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-xrx9-gj26-5wx9","title":"v8n vulnerable to Inefficient Regular Expression Complexity","description":"### Impact\nInefficient regular expression complexity of `lowercase()` and `uppercase()` regex could lead to a denial of service attack. With a formed payload `'a' + 'a'.repeat(i) + 'A'`, only 32 characters payload could take 29443 ms time execution when testing `lowercase()`. The same issue happens with `uppercase()`.\n\n### Patches\nv1.5.1\n\n### References\n[huntr.dev report](https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609)\n[_Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking_](https://snyk.io/blog/redos-and-catastrophic-backtracking/)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [v8n issues list](https://github.com/imbrn/v8n)\n* Email us at [brunodev02221@gmail.com](mailto:brunodev02221@gmail.com)\n","status":"published","published":"2022-10-07T07:33:44Z","modified":"2023-11-08T04:09:52.856541Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}