VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 2, 2021· Updated Aug 3, 2024

Inefficient Regular Expression Complexity in validatorjs/validator.js

CVE-2021-3765

Description

validator.js is vulnerable to Inefficient Regular Expression Complexity

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The rtrim function in validator.js before 13.6.6 is vulnerable to ReDoS via a crafted string with many trailing whitespace characters.

Vulnerability

The rtrim function in validator.js before version 13.6.6 used a regular expression /(\s)+$/g for trimming whitespace. This regex can cause catastrophic backtracking on strings with many trailing whitespace characters, leading to a Regular Expression Denial of Service (ReDoS) attack. [1][3]

Exploitation

An attacker can provide a string with a large number of whitespace characters (e.g., spaces) at the end, causing the regex engine to take exponential time to evaluate. No authentication or special privileges are needed; simply calling rtrim on such input triggers the slowdown. [3][4]

Impact

Successful exploitation allows an attacker to cause high CPU consumption, potentially leading to denial of service for the application using validator.js. The vulnerability has a CVSS base score of 7.5 (High) with availability impact. [2]

Mitigation

The fix was implemented in commit 496fc8b2 [3] and released in validator.js version 13.6.6. Users should upgrade to version 13.6.6 or later. There are no known workarounds other than avoiding the rtrim function with untrusted input before patching. [1][2]

References
  1. GitHub - validatorjs/validator.js: String validation
  2. NVD - CVE-2021-3765
  3. fix(rtrim): remove regex to prevent ReDOS attack (#1738) · validatorjs/validator.js@496fc8b
  4. The world’s first bug bounty platform for AI/ML

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
validatornpm
< 13.7.013.7.0

Affected products

2
  • ghsa-coords
    pkg:npm/validator
    Range: < 13.7.0
  • validatorjs/validatorjs/validator.jsv5
    Range: unspecified

Patches

1
496fc8b2a7f5

fix(rtrim): remove regex to prevent ReDOS attack (#1738)

https://github.com/validatorjs/validator.jsSarhan AissiNov 1, 2021via ghsa
commit
1 file changed · +12 −3
  • src/lib/rtrim.js+12 −3 modified
    @@ -2,7 +2,16 @@ import assertString from './util/assertString';
 
 export default function rtrim(str, chars) {
   assertString(str);
-  // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
-  const pattern = chars ? new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g') : /(\s)+$/g;
-  return str.replace(pattern, '');
+  if (chars) {
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
+    const pattern = new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g');
+    return str.replace(pattern, '');
+  }
+  // Use a faster and more safe than regex trim method https://blog.stevenlevithan.com/archives/faster-trim-javascript
+  let strIndex = str.length - 1;
+  while (/\s/.test(str.charAt(strIndex))) {
+    strIndex -= 1;
+  }
+
+  return str.slice(0, strIndex + 1);
 }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.