CVE-2026-63460 Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes th...

EUVD-2026-81299

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the isoDate validation rule. An attacker can cause the application to become unresponsive by submitting a specially crafted string containing a valid ISO date followed by a long sequenc...

CVE-2026-92599

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

CVE-2026-92599

joi (npm package, hapi.js) versions >=17.2.0 =18.0.0

EUVD-2026-80011

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/webcore/src/v09/basiccatalog/functions/saferegex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be...

CVE-2026-92114

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/webcore/src/v09/basiccatalog/functions/saferegex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be...

CVE-2026-92114 a2ui-project a2ui Basic Catalog safe_regex.ts redos

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/webcore/src/v09/basiccatalog/functions/saferegex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be...

CVE-2026-92114

a2ui-project a2ui versions up to 0.10.6 are affected by a Regular Expression Denial of Service (ReDoS) vulnerability in the Basic Catalog component, specifically in the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts. The root cause is inefficient regular expression complex...

CVE-2026-76821

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

CVE-2026-76821 OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

CVE-2026-76821 OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

CVE-2026-76821

OpenCTI , an open-source cyber threat intelligence platform, is vulnerable to user-controlled ReDoS in the JSON ingestion mapper's extractWithRegexp formula function (prior to 7.260706.0 ). The function compiled a user-supplied regular expression with the JavaScript RegExp engine without validati...

CVE-2026-76821 OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

rabbitmq: RabbitMQ: Denial of Service via management API regular expression filter

A flaw was found in RabbitMQ. A remote attacker with management privileges could exploit a regular expression regex filter in the management API by providing a specially crafted regex to the ?name= filter. This vulnerability, known as Regular Expression Denial of Service ReDoS, causes excessive C...

PT-2026-92469

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

CVE-2026-57577

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a...