CVE-2022-35923

    Dashboard / Vulnerabilities / CVE-2022-35923

    CVE-2022-35923

    Published: 2 Aug 2022Last Modified: 12 Aug 2026

    Summary: Inefficient Regular Expression Complexity in v8n

    Details: v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.

    References: https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35923.json, https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9, https://nvd.nist.gov/vuln/detail/CVE-2022-35923, https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -60afb53baab7c2e8de4dd9141633753a3a018a39

    Affected versions

    v1.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-35923 | CVE-DB