@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation

published 2026-07-02 4mo ago modified 2026-09-10 2mo ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

## Summary

The `HTMLInputElement.checkValidity()` method constructed a `RegExp` directly from the user-controlled `pattern` property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop.

## Fix

Fixed in commit https://github.com/asymmetric-effort/NogginLessDom/commit/25a3cbac665fae5663f8b71c073b80c3152dbe7b on `main`. Added: - Pattern length limit (1024 characters) - Nested quantifier detection (`hasNestedQuantifiers`) that rejects patterns like `(a+)+` before constructing the regex - Patterns exceeding limits are treated as non-matching (safe default)

Patch / fix

fixed in 1 links 1

npm @asymmetric-effort/nogginlessdom 0.0.22

github.com/asymmetric-effort/NogginLessDom@25a3cba commit

Is GHSA-x4hg-hfwf-p9mw in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	@asymmetric-effort/nogginlessdom	<0.0.22	0.0.22

Classification

Weakness

CWE-1333 Inefficient Regular Expression Complexity

References

Sources

GitHub Advisory GHSA-x4hg-hfwf-p9mw

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.