What’s Vulnerable › Vulnerabilities

CVE-2021-3794: Inefficient Regular Expression Complexity in vuelidate/vuelidate

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-15 · updated 2026-06-17
• Weakness: CWE-1333

Description

vuelidate is vulnerable to Inefficient Regular Expression Complexity

Affected products

• vuelidate/vuelidate: before 0.7.7; 1.0.0-alpha1, 1.0.0-alpha2, 2.0.0-alpha0, 2.0.0-alpha1, 2.0.0-alpha10, 2.0.0-alpha11 (+21) — fixed in 0.7.7

How to fix

Upgrade to a fixed version: vuelidate/vuelidate 0.7.7. Check the vendor advisory for mitigations.

References

• https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d
• https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7
• https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d
• https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7

Get alerted when CVE-2021-3794 or the next vulnerability affects your stack