CVE-2016-2537

HIGH

is-my-json-valid < 2.12.4 - Denial of Service via Crafted String

Title source: llm

Description

The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.

References (2)

Core 2

Core References

Various Sources x_refsource_confirm

https://nodesecurity.io/advisories/76

Patch x_refsource_confirm

https://github.com/mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b

Scores

CVSS v3 7.5

EPSS 0.0185

EPSS Percentile 76.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-20

Status published

Products (2)

is_my_json_valid_project/is_my_json_valid < 2.12.3

npm/is-my-json-valid 0 - 2.12.4npm

Published Feb 23, 2016

Tracked Since Feb 18, 2026