Medium severity6.5NVD Advisory· Published Sep 21, 2026· Updated Sep 24, 2026
CVE-2026-58270
CVE-2026-58270
Description
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern (e.g. ^(a+)+b) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@sync-in/servernpm | < 2.4.0 | 2.4.0 |
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-jx63-h26r-8cphghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-58270ghsaADVISORY
- github.com/Sync-in/server/commit/b1dcaa1d1c1bb17ab6c31a404cc9cead7efdd979ghsaWEB
- github.com/Sync-in/server/pull/228ghsaWEB
- github.com/Sync-in/server/releases/tag/v2.4.0ghsaWEB
- github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cphnvdWEB
News mentions
0No linked articles in our index yet.