VYPR
← All advisories
Medium severity6.0NVD Advisory· Published Mar 17, 2025· Updated Apr 15, 2026

CVE-2025-26042

CVE-2025-26042

Description

Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
uptime-kumanpm
>= 1.15.0, <= 1.23.16—
uptime-kumanpm
>= 2.0.0-beta.0, < 2.0.0-beta.22.0.0-beta.2

Patches

1
7a9191761dbe

fix: make sure that stripping backslashes for notification urls cannot cause catastophic backtracking (ReDOS) (#5573)

https://github.com/louislam/uptime-kumaDayShiftJan 26, 2025via ghsa
commit
2 files changed · +3 −2
  • server/notification-providers/pushdeer.js+2 −1 modified
    @@ -11,7 +11,8 @@ class PushDeer extends NotificationProvider {
     async send(notification, msg, monitorJSON = null, heartbeatJSON = null) {
         const okMsg = "Sent Successfully.";
         const serverUrl = notification.pushdeerServer || "https://api2.pushdeer.com";
-        const url = `${serverUrl.trim().replace(/\/*$/, "")}/message/push`;
+        // capture group below is nessesary to prevent an ReDOS-attack
+        const url = `${serverUrl.trim().replace(/([^/])\/+$/, "$1")}/message/push`;
 
         let valid = msg != null && monitorJSON != null && heartbeatJSON != null;
  • server/notification-providers/whapi.js+1 −1 modified
    @@ -24,7 +24,7 @@ class Whapi extends NotificationProvider {
                 "body": msg,
             };
 
-            let url = (notification.whapiApiUrl || "https://gate.whapi.cloud/").replace(/\/+$/, "") + "/messages/text";
+            let url = (notification.whapiApiUrl || "https://gate.whapi.cloud/").replace(/([^/])\/+$/, "$1") + "/messages/text";
 
             await axios.post(url, data, config);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.