Skip to content

CVE-2016-2537 Regular Expression Denial of Service in is-my-json-valid

HighCVSS 7.5 EPSS 1.8%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.

Affected products

ProductAffected versionsFixed in
is my json valid project is my json valid <= 2.12.3 No fix listed
npm is-my-json-valid(npm) < 2.12.4 2.12.4

References