PT-2021-21930 · Vuelidate · Vuelidate

Dobromir-Hristov · Published 2021-09-15 · Updated 2025-09-24 · CVE-2021-3794

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: vuelidate versions 2.x through 3.0

Description: The issue is related to Inefficient Regular Expression Complexity, specifically a ReDoS (regular expression denial of service) flaw found in the @vuelidate/validators package. This flaw can be exploited if an attacker provides crafted input to the url function, potentially causing the application to consume an excessive amount of CPU.

Recommendations: For vuelidate versions 2.x through 3.0, consider disabling the url function in the @vuelidate/validators package as a temporary workaround until a patch is available. Restrict access to this function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-697

CWE-1333

CWE-400

Related Identifiers

CVE-2021-3794

GHSA-VVF2-PPJ9-PP49

Affected Products

Vuelidate

References · 9

• 🔥 https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7 · Exploit
• https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d · Patch
• https://osv.dev/vulnerability/CVE-2021-3794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3794 · Security Note
• https://osv.dev/vulnerability/GHSA-vvf2-ppj9-pp49 · Vendor Advisory
• https://github.com/vuelidate/vuelidate · Note
• https://t.me/cveNotify/136352 · Telegram Post
• https://t.me/cvenotify/20891 · Telegram Post
• https://t.me/cvenotify/21547 · Telegram Post