CVE-2020-26302

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to loop “forever." This vulnerability was found using a CodeQL query which identifies inefficient regular expressions. is.js has no patch for this issue.

• CWE-400
• CWE-1333

• https://github.com/arasatasaygin/is.js/issues/320Issue Tracking, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2020-295-redos-is.jsExploit, Third Party Advisory
• https://github.com/arasatasaygin/is.js/issues/320Issue Tracking, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2020-295-redos-is.jsExploit, Third Party Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26297mdBook is a utility to create modern online books from Markd…6.1
• CVE-2020-26298Redcarpet is a Ruby library for Markdown processing. In Redc…5.4
• CVE-2020-26299ftp-srv is an open-source FTP server designed to be simple y…9.6
• CVE-2020-2630Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26300systeminformation is an npm package that provides system and…9.8
• CVE-2020-26301ssh2 is client and server modules written in pure JavaScript…10
• CVE-2020-26303insane is a whitelist-oriented HTML sanitizer. Versions 2.6.…7.5
• CVE-2020-26304Foundation is a front-end framework. Versions 6.3.3 and prio…7.5
• CVE-2020-26305CommonRegexJS is a CommonRegex port for JavaScript. All avai…7.5
• CVE-2020-26306Knwl.js is a Javascript library that parses through text for…8.7
• CVE-2020-26307HTML2Markdown is a Javascript implementation for converting …8.7
• CVE-2020-26308Validate.js provides a declarative way of validating javascr…7.5