valibot
NPM
Releases97
Frequency1 week 4 days
Last Release
The modular and type safe schema library for validating structural data
CVE History
| CVE | Affected | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|---|
| < 1.4.2 | — | — | ||
Valibot: record() issue paths can make flatten() throw for inherited Object property names | ||||
| >= 0.31.0, < 1.2.0 | 7.5 HIGH | — | ||
Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can cause the regex engine to consume excessive CPU time (minutes), leading to a Denial of Service (DoS) for the application. This issue has been patched in version 1.2.0. | ||||