{"id":"CVE-2021-3794","details":"vuelidate is vulnerable to Inefficient Regular Expression Complexity","aliases":["GHSA-vvf2-ppj9-pp49"],"modified":"2026-07-08T06:03:32.107542295Z","published":"2021-09-15T13:15:08.167Z","database_specific":{"unresolved_ranges":[{"vendor_product":"vuelidate_project:vuelidate","cpes":["cpe:2.3:a:vuelidate_project:vuelidate:1.0.0:alpha1:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:1.0.0:alpha2:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha0:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha10:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha11:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha12:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha13:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha14:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha15:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha16:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha17:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha18:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha19:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha1:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha20:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha21:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha22:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha23:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha24:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha25:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha2:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha3:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha5:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha6:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha7:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha8:*:*:*:node.js:*:*","cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha9:*:*:*:node.js:*:*"],"extracted_events":[{"introduced":"1.0.0-alpha1"},{"last_affected":"1.0.0-alpha1"},{"introduced":"1.0.0-alpha2"},{"last_affected":"1.0.0-alpha2"},{"introduced":"2.0.0-alpha0"},{"last_affected":"2.0.0-alpha0"},{"introduced":"2.0.0-alpha1"},{"last_affected":"2.0.0-alpha1"},{"introduced":"2.0.0-alpha10"},{"last_affected":"2.0.0-alpha10"},{"introduced":"2.0.0-alpha11"},{"last_affected":"2.0.0-alpha11"},{"introduced":"2.0.0-alpha12"},{"last_affected":"2.0.0-alpha12"},{"introduced":"2.0.0-alpha13"},{"last_affected":"2.0.0-alpha13"},{"introduced":"2.0.0-alpha14"},{"last_affected":"2.0.0-alpha14"},{"introduced":"2.0.0-alpha15"},{"last_affected":"2.0.0-alpha15"},{"introduced":"2.0.0-alpha16"},{"last_affected":"2.0.0-alpha16"},{"introduced":"2.0.0-alpha17"},{"last_affected":"2.0.0-alpha17"},{"introduced":"2.0.0-alpha18"},{"last_affected":"2.0.0-alpha18"},{"introduced":"2.0.0-alpha19"},{"last_affected":"2.0.0-alpha19"},{"introduced":"2.0.0-alpha2"},{"last_affected":"2.0.0-alpha2"},{"introduced":"2.0.0-alpha20"},{"last_affected":"2.0.0-alpha20"},{"introduced":"2.0.0-alpha21"},{"last_affected":"2.0.0-alpha21"},{"introduced":"2.0.0-alpha22"},{"last_affected":"2.0.0-alpha22"},{"introduced":"2.0.0-alpha23"},{"last_affected":"2.0.0-alpha23"},{"introduced":"2.0.0-alpha24"},{"last_affected":"2.0.0-alpha24"},{"introduced":"2.0.0-alpha25"},{"last_affected":"2.0.0-alpha25"},{"introduced":"2.0.0-alpha3"},{"last_affected":"2.0.0-alpha3"},{"introduced":"2.0.0-alpha5"},{"last_affected":"2.0.0-alpha5"},{"introduced":"2.0.0-alpha6"},{"last_affected":"2.0.0-alpha6"},{"introduced":"2.0.0-alpha7"},{"last_affected":"2.0.0-alpha7"},{"introduced":"2.0.0-alpha8"},{"last_affected":"2.0.0-alpha8"},{"introduced":"2.0.0-alpha9"},{"last_affected":"2.0.0-alpha9"}],"source":"CPE_STRING"}]},"references":[{"type":"FIX","url":"https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d"},{"type":"FIX","url":"https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vuelidate/vuelidate","events":[{"introduced":"0"},{"fixed":"f55f8f80bcd964ef2af587b313456ecc85c99b61"},{"fixed":"1f0ca31c30e5032f00dbd14c4791b5ee7928f71d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.7.7"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:vuelidate_project:vuelidate:*:*:*:*:*:*:*:*"}}],"versions":["@vuelidate/core@2.0.0-alpha.25","@vuelidate/components@1.1.5","@vuelidate/validators@2.0.0-alpha.21","@vuelidate/core@2.0.0-alpha.24","@vuelidate/components@1.1.4","@vuelidate/validators@2.0.0-alpha.20","@vuelidate/core@2.0.0-alpha.23","@vuelidate/components@1.1.3","@vuelidate/validators@2.0.0-alpha.19","@vuelidate/core@2.0.0-alpha.22","@vuelidate/components@1.1.2","@vuelidate/docs@2.0.0-alpha.25","@vuelidate/core@2.0.0-alpha.21","@vuelidate/components@1.1.1","test-project@0.6.0","@vuelidate/validators@2.0.0-alpha.18","@vuelidate/docs@2.0.0-alpha.24","@vuelidate/core@2.0.0-alpha.20","@vuelidate/components@1.1.0","@vuelidate/validators@2.0.0-alpha.17","@vuelidate/docs@2.0.0-alpha.23","@vuelidate/validators@2.0.0-alpha.16","@vuelidate/docs@2.0.0-alpha.22","@vuelidate/core@2.0.0-alpha.19","test-project@0.5.0","@vuelidate/validators@2.0.0-alpha.15","@vuelidate/docs@2.0.0-alpha.21","@vuelidate/core@2.0.0-alpha.18","@vuelidate/validators@2.0.0-alpha.14","@vuelidate/docs@2.0.0-alpha.20","@vuelidate/core@2.0.0-alpha.17","@vuelidate/docs@2.0.0-alpha.19","@vuelidate/core@2.0.0-alpha.16","@vuelidate/validators@2.0.0-alpha.13","@vuelidate/docs@2.0.0-alpha.18","@vuelidate/core@2.0.0-alpha.15","@vuelidate/docs@2.0.0-alpha.17","@vuelidate/core@2.0.0-alpha.14","@vuelidate/validators@2.0.0-alpha.12","@vuelidate/docs@2.0.0-alpha.16","@vuelidate/core@2.0.0-alpha.13","@vuelidate/validators@2.0.0-alpha.11","@vuelidate/docs@2.0.0-alpha.15","test-project@0.4.0","@vuelidate/validators@2.0.0-alpha.10","@vuelidate/docs@2.0.0-alpha.14","@vuelidate/core@2.0.0-alpha.12","@vuelidate/validators@2.0.0-alpha.9","@vuelidate/docs@2.0.0-alpha.13","@vuelidate/docs@2.0.0-alpha.12","@vuelidate/core@2.0.0-alpha.11","@vuelidate/validators@2.0.0-alpha.8","@vuelidate/docs@2.0.0-alpha.11","@vuelidate/core@2.0.0-alpha.10","@vuelidate/validators@2.0.0-alpha.7","@vuelidate/docs@2.0.0-alpha.10","test-project@0.3.0","@vuelidate/validators@2.0.0-alpha.6","@vuelidate/docs@2.0.0-alpha.9","@vuelidate/core@2.0.0-alpha.9","test-project@0.2.4","@vuelidate/docs@2.0.0-alpha.8","@vuelidate/core@2.0.0-alpha.8","@vuelidate/validators@2.0.0-alpha.5","@vuelidate/docs@2.0.0-alpha.7","@vuelidate/core@2.0.0-alpha.7","@vuelidate/validators@2.0.0-alpha.4","@vuelidate/docs@2.0.0-alpha.6","@vuelidate/core@2.0.0-alpha.6","test-project@0.2.3","@vuelidate/validators@2.0.0-alpha.3","@vuelidate/docs@2.0.0-alpha.5","@vuelidate/core@2.0.0-alpha.5","v0.7.6","test-project@0.2.2","@vuelidate/docs@2.0.0-alpha.4","@vuelidate/core@2.0.0-alpha.4","@vuelidate/docs@2.0.0-alpha.3","@vuelidate/core@2.0.0-alpha.3","test-project@0.2.1","@vuelidate/validators@2.0.0-alpha.2","@vuelidate/docs@2.0.0-alpha.2","@vuelidate/core@2.0.0-alpha.2","test-project@0.2.0","@vuelidate/validators@2.0.0-alpha.1","@vuelidate/docs@2.0.0-alpha.1","@vuelidate/core@2.0.0-alpha.1","v0.7.5","@vuelidate/validators@2.0.0-alpha.0","@vuelidate/docs@2.0.0-alpha.0","@vuelidate/core@2.0.0-alpha.0","@vuelidate/validators@1.0.0-alpha.2","@vuelidate/core@1.0.0-alpha.2","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.2","v0.6.1","v0.6.0","v0.5.0","v0.4.3","v0.4.2","v0.4.1","v0.4.0","v0.3.1","v0.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3794.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}