CVE-2020-26309

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any patches are available.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green

Weakness enumeration

CWE-1333

Affected software

VendorProductVersions
ftonatonope-validator<= 0.11.3
ftonatonope-validator<= 0.11.3

References

Timeline

Published
Oct 26, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2020

CVE-2020-26316.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). SuppCVE-2020-263108.7Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expCVE-2020-263117.5Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerCVE-2020-263128.1Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsaCVE-2020-26326.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: System Monitoring). Supported versionCVE-2020-26336.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versiCVE-2020-26346.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Configuration Standard Framewk). SuppCVE-2020-26356.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: System Monitoring). Supported versionCVE-2020-26366.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). SuppCVE-2020-26376.0Vulnerability in the Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Change Manager - web based). SuCVE-2020-26386.0Vulnerability in the Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Enterprise Config Management). CVE-2020-26396.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). Supported versions
CVE-2020-26309: High severity, CVSS 8.7 | Vulnix