Vulnerability Description
Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can cause the regex engine to consume excessive CPU time (minutes), leading to a Denial of Service (DoS) for the application. This issue has been patched in version 1.2.0.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/open-circle/valibot/commit/cfb799db301a953a0950d5c05a34a3ab12
- https://github.com/open-circle/valibot/security/advisories/GHSA-vqpr-j7v3-hqw9
FAQ
What is CVE-2025-66020?
CVE-2025-66020 is a vulnerability with a CVSS score of 7.5 (HIGH). Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, ...
How severe is CVE-2025-66020?
CVE-2025-66020 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-66020?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.