Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.

Affected: npm: @sync-in/server

**Affected component:** Sync-in Server v2.3.0, `POST /api/app/sync/operation/diff/:id`, vulnerable implementation of `pathFilters` in `backend/src/applications/sync/dtos/sync-operations.dto.ts`.

## Summary

In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through `pathFilters` and compiled it into a `RegExp` without complexity validation. The resulting regex was then executed synchronously against relative file paths during diff generation.

A catastrophic-backtracking pattern, such as `^(a+)+b`, can block the affected Node.js event loop when evaluated against a worst-case path shape. In a single-process deployment, this can make the server unavailable to other users while the regex evaluation is running. Repeated malicious requests can sustain the denial of service.

## Details

`SyncDiffDto` transformed user input directly into a `RegExp` without validating regex complexity: ```typescript // backend/src/applications/sync/dtos/sync-operations.dto.ts @IsOptional() @Transform(({ value }) => (typeof value === 'string' && value.length > 0 ? new RegExp(value, 'i') : null)) pathFilters?: RegExp = null ``` The compiled regex was then executed synchronously during sync diff traversal: ```typescript // backend/src/applications/sync/services/sync-manager.service.ts if (ctx.syncDiff.pathFilters && ctx.syncDiff.pathFilters.test(filePath)) { ``` Because `.test()` is synchronous, a catastrophic-backtracking pattern can block the Node.js event lo…