Snyk Security Database

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the email validation rule when its multiple option is enabled. An attacker can block the Node.js event loop by submitting a long run of whitespace with no separator to a field validated with Joi.string().email({ multiple: true }), because the value is split with a regex whose leading \s* is retried from each position inside a whitespace run and backtracks through the rest of it, costing n squared steps for n whitespace characters. This is reached only when the application validates untrusted input with the multiple email option and applies no length limit before the email rule runs.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the vtkWindBladeReader::LoadVariableData method in IO/Geometry/vtkWindBladeReader.cxx. An attacker can cause a deterministic crash, and on non-instrumented builds disclose heap-resident data through the output arrays, by supplying a .wind dataset whose binary byteCount field is between -3 and 3 so that FindVariableOffsets() computes BlockSize = byteCount / 4 as zero, after which block is allocated from that zero size while the read and grid iteration, driven by the attacker-controlled GRID_SIZE_X/Y/Z metadata, run past the allocation. This requires the application to open an untrusted .wind dataset through the WindBlade reader.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the email validation rule when its multiple option is enabled. An attacker can block the Node.js event loop by submitting a long run of whitespace with no separator to a field validated with Joi.string().email({ multiple: true }), because the value is split with a regex whose leading \s* is retried from each position inside a whitespace run and backtracks through the rest of it, costing n squared steps for n whitespace characters. This is reached only when the application validates untrusted input with the multiple email option and applies no length limit before the email rule runs.