GHSA-x4hg-hfwf-p9mw

Summary

@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation

Severity

medium

CWE

CWE-1333

Published

2026-07-02

Updated

2026-07-02

Advisory details

Summary

The HTMLInputElement.checkValidity() method constructed a RegExp directly from the user-controlled pattern property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop.

Fix

Fixed in commit https://github.com/asymmetric-effort/NogginLessDom/commit/25a3cbac665fae5663f8b71c073b80c3152dbe7b on main. Added:

• Pattern length limit (1024 characters)
• Nested quantifier detection (hasNestedQuantifiers) that rejects patterns like (a+)+ before constructing the regex
• Patterns exceeding limits are treated as non-matching (safe default)

References

• https://github.com/advisories/GHSA-x4hg-hfwf-p9mw
• https://github.com/asymmetric-effort/NogginLessDom/security/advisories/GHSA-x4hg-hfwf-p9mw
• https://github.com/asymmetric-effort/NogginLessDom/commit/25a3cbac665fae5663f8b71c073b80c3152dbe7b

Related advisories

• GHSA-322x-v876-g883 — high · npm/@asymmetric-effort/nogginlessdom
• CVE-2026-52778 — critical · Packagist/yeswiki/yeswiki
• CVE-2026-86081 — high · npm/n8n
• GHSA-j95f-988m-3j2f — high · npm/@tiptap/core
• CVE-2026-83619 — high · npm/@xmldom/xmldom
• CVE-2026-83606 — high · npm/@xmldom/xmldom
• CVE-2026-80206 — high · PyPI/nltk
• CVE-2026-80205 — high · PyPI/nltk

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity