{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-20T00:15:30.338","vulnerabilities":[{"cve":{"id":"CVE-2020-26302","sourceIdentifier":"security-advisories@github.com","published":"2022-12-22T21:15:08.877","lastModified":"2024-11-21T05:19:48.677","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to loop “forever.\" This vulnerability was found using a CodeQL query which identifies inefficient regular expressions. is.js has no patch for this issue."},{"lang":"es","value":"is.js es una librería de verificación de uso general. Las versiones 0.9.0 y anteriores contienen una o más expresiones regulares que son vulnerables a la denegación de servicio de expresión regular (ReDoS). is.js utiliza una expresión regular copiada y pegada de una esencia para validar las URL. Intentar validar una cadena maliciosa puede hacer que la expresión regular se repita \"forever\". Esta vulnerabilidad se encontró mediante una consulta CodeQL que identifica expresiones regulares ineficientes. is.js no tiene ningún parche para este problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:is.js_project:is.js:*:*:*:*:*:*:*:*","versionEndIncluding":"0.9.0","matchCriteriaId":"DB03F6BF-42D8-4F49-B419-972FBF5CC3B7"}]}]}],"references":[{"url":"https://github.com/arasatasaygin/is.js/issues/320","source":"security-advisories@github.com","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-295-redos-is.js","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/arasatasaygin/is.js/issues/320","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-295-redos-is.js","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}