npm/is-my-json-valid CVE-2016-2537: high 7.5, EPSS 1.85%

Regular Expression Denial of Service in is-my-json-valid

Action: Upgrade is-my-json-valid to 2.12.4 or later.

npm i is-my-json-valid@2.12.4

Affected

Fixed versions

Sources

• osv: GHSA-f522-ffg8-j8r6
• https://nvd.nist.gov/vuln/detail/CVE-2016-2537
• https://github.com/github/advisory-database/pull/4850
• https://github.com/mafintosh/is-my-json-valid/pull/159
• https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976
• https://github.com/mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b
• https://hackerone.com/reports/317548
• https://github.com/advisories/GHSA-f522-ffg8-j8r6
• https://github.com/mafintosh/is-my-json-valid
• https://www.npmjs.com/advisories/572
• https://www.npmjs.com/advisories/76

CVE-2016-2537 · published 2017-10-24T18:33:35Z · modified 2025-10-17T17:50:27Z · JSON