CVE-2021-3794: @vuelidate/validators Inefficient Regular Expression Complexity Vulnerability

HIGH
Advisory Identifier: GHSA-vvf2-ppj9-pp49
Share
CVSS 7.5
CWE-400 CWE-1333 CWE-697
Published
Advisory Summary

CVE-2021-3794 is a HIGH (CVSS 7.5) inefficient regular expression complexity vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting @vuelidate/validators libraries in the npm ecosystem. The issue involves inefficient regular expression complexity in vuelidate. Remediation is available by upgrading affected packages to version 2.0.0-alpha.22.

CVE-2021-3794 at a Glance

CVE Identifier CVE-2021-3794
GHSA Identifier GHSA-vvf2-ppj9-pp49
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification CWE-400: Uncontrolled Resource Consumption
Affected Product @vuelidate/validators
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2021-3794

To remediate this vulnerability, upgrade all affected @vuelidate/validators dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@vuelidate/validators fixed: 2.0.0-alpha.22 
npm install @vuelidate/validators@2.0.0-alpha.22
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @vuelidate/validators

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2021-3794, inspect your project dependencies using npm:

npm ls @vuelidate/validators

Analyze the terminal output to locate any version of @vuelidate/validators in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.0.0-alpha.22), your application is affected.

Note: The npm ls @vuelidate/validators command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In @vuelidate/validators, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the `@vuelidate/validators` package. An attacker that is able to provide crafted input to the url(input) function may cause an application to consume an excessive amount of CPU.

CVE-2021-3794 Affected @vuelidate/validators Versions

1 component(s)
Fixed Versions:
2.0.0-alpha.22
Product / Package Ecosystem Affected Versions Fixed Version
@vuelidate/validators
npm/@vuelidate/validators
npm
< 2.0.0-alpha.22
2.0.0-alpha.22

References

NVD — CVE-2021-3794 NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3794
Security Fix Commit FIX COMMIT
https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d
@vuelidate/validators Source Repository REPOSITORY
https://github.com/vuelidate/vuelidate
huntr.dev/bounties/d8201b98-f... WEB
https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7

Frequently Asked Questions

What is CVE-2021-3794?
CVE-2021-3794 is a security vulnerability in @vuelidate/validators involving Inefficient Regular Expression Complexity in vuelidate under CWE-400: Uncontrolled Resource Consumption.
Which @vuelidate/validators versions are affected?
Affected versions include releases prior to 2.0.0-alpha.22 across affected packages: @vuelidate/validators.
What version fixes CVE-2021-3794?
Upgrading to 2.0.0-alpha.22 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @vuelidate/validators affected?
Yes, @vuelidate/validators is affected in releases prior to 2.0.0-alpha.22. Upgrade your dependency to 2.0.0-alpha.22 or later.
What is the CVSS score of CVE-2021-3794?
CVE-2021-3794 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2021-3794?
CVE-2021-3794 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).
How can I check npm dependencies for CVE-2021-3794?
Run the dependency tree command: 'npm ls @vuelidate/validators'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vvf2-ppj9-pp49",
  "modified" : "2022-05-04T03:24:54Z",
  "published" : "2021-09-20T20:42:06Z",
  "aliases" : [ "CVE-2021-3794" ],
  "summary" : "Inefficient Regular Expression Complexity in vuelidate",
  "details" : "vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the `@vuelidate/validators` package. An attacker that is able to provide crafted input to the url(input) function may cause an application to consume an excessive amount of CPU.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@vuelidate/validators"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.0.0-alpha.22"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.0.0-alpha.21"
    }
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-3794"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/vuelidate/vuelidate"
  }, {
    "type" : "WEB",
    "url" : "https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1333", "CWE-400", "CWE-697" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2021-09-16T17:15:49Z",
    "nvd_published_at" : "2021-09-15T13:15:00Z"
  }
}