Description
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.
References (3)
Core 3
Core References
Third Party Advisory x_refsource_confirm
https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9
Patch, Third Party Advisory x_refsource_misc
https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9
Exploit, Third Party Advisory x_refsource_misc
https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/
Scores
CVSS v3
7.5
EPSS
0.0133
EPSS Percentile
67.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-1333
CWE-400
Status
published
Products (2)
npm/v8n
0 - 1.5.1npm
v8n_project/v8n
< 1.5.1
Published
Aug 02, 2022
Tracked Since
Feb 18, 2026