CVE-2020-1920

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-01 · updated 2026-06-17
Weakness: CWE-1333

Description

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.

Affected products

Facebook react-native: from 0.59.0 before 0.64.1 — fixed in 0.64.1

How to fix

Upgrade to a fixed version: Facebook react-native 0.64.1. Check the vendor advisory for mitigations.

References

https://github.com/facebook/react-native/commit/ca09ae82715e33c9ac77b3fa55495cf84ba891c7
https://github.com/facebook/react-native/releases/tag/v0.64.1
https://github.com/facebook/react-native/commit/ca09ae82715e33c9ac77b3fa55495cf84ba891c7
https://github.com/facebook/react-native/releases/tag/v0.64.1

Get alerted when CVE-2020-1920 or the next vulnerability affects your stack