What’s Vulnerable › Vulnerabilities

CVE-2016-2537

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-02-23 · updated 2026-06-17
• Weakness: CWE-20

Description

The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.

Affected products

• Is My Json Valid Project Is My Json Valid: through 2.12.3

References

• https://github.com/mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b
• https://nodesecurity.io/advisories/76
• https://github.com/mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b
• https://nodesecurity.io/advisories/76

Get alerted when CVE-2016-2537 or the next vulnerability affects your stack