-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is clearly tied to the 'uri' validator regex shown in the commit diff. The patch modified the regex pattern from '(/?(?:[a-z0-9-.~!$&'()*+,;=:@]|%[0-9A-F]{2})+)' to '(/?(?:[a-z0-9-.~!$&'()+,;=:@]|%[0-9A-F]{2})(?:[...]))', specifically addressing the inefficient quantifier usage. This regex is part of the format validators defined in base.js, which are used for schema validation. The CWE-1333 classification and commit message confirming ReDoS resolution provide high confidence in this assessment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| skeemas | npm | < 1.2.5 | 1.2.5 |