CVE-2022-35923

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-1333

Affected software

Vendor	Product	Versions
imbrn	v8n	< 1.5.1

References

https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9Patch, Third Party Advisory
https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9Third Party Advisory
https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/Exploit, Third Party Advisory
https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9Patch, Third Party Advisory
https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9Third Party Advisory
https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/Exploit, Third Party Advisory

Timeline

Published: Aug 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-359249.1NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` CVE-2022-359259.8BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which al CVE-2022-359267.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery CVE-2022-359279.8Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Con CVE-2022-359285.5AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version CVE-2022-359299.8cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation ex CVE-2022-359308.8PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will r CVE-2022-359312.7Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, CVE-2022-359325.3Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected convers CVE-2022-359336.1This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could s CVE-2022-359347.5TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of s CVE-2022-359357.5TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHE