What’s Vulnerable › Vulnerabilities

CVE-2022-35923: Inefficient Regular Expression Complexity in v8n

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-02 · updated 2026-06-17
• Weakness: CWE-400

Description

v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• imbrn v8n: before 1.5.1 — fixed in 1.5.1

How to fix

Upgrade to a fixed version: imbrn v8n 1.5.1. Check the vendor advisory for mitigations.

References

• https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9
• https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9
• https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/
• https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9
• https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9
• https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/

Get alerted when CVE-2022-35923 or the next vulnerability affects your stack