https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 20:44:22 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-58270 <p>Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.</p> <p>Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.</p> https://db.gcve.eu/vuln/fkie_cve-2026-58270 https://db.gcve.eu/vuln/ghsa-jx63-h26r-8cph <p><strong>Affected:</strong> npm: @sync-in/server</p> <p>**Affected component:** Sync-in Server v2.3.0, `POST /api/app/sync/operation/diff/:id`, vulnerable implementation of `pathFilters` in `backend/src/applications/sync/dtos/sync-operations.dto.ts`.</p> <p>## Summary</p> <p>In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through `pathFilters` and compiled it into a `RegExp` without complexity validation. The resulting regex was then executed synchronously against relative file paths during diff generation.</p> <p>A catastrophic-backtracking pattern, such as `^(a+)+b`, can block the affected Node.js event loop when evaluated against a worst-case path shape. In a single-process deployment, this can make the server unavailable to other users while the regex evaluation is running. Repeated malicious requests can sustain the denial of service.</p> <p>## Details</p> <p>`SyncDiffDto` transformed user input directly into a `RegExp` without validating regex complexity: ```typescript // backend/src/applications/sync/dtos/sync-operations.dto.ts @IsOptional() @Transform(({ value }) =&gt; (typeof value === &#39;string&#39; &amp;&amp; value.length &gt; 0 ? new RegExp(value, &#39;i&#39;) : null)) pathFilters?: RegExp = null ``` The compiled regex was then executed synchronously during sync diff traversal: ```typescript // backend/src/applications/sync/services/sync-manager.service.ts if (ctx.syncDiff.pathFilters &amp;&amp; ctx.syncDiff.pathFilters.test(filePath)) { ``` Because `.test()` is synchronous, a catastrophic-backtracking pattern can block the Node.js event lo…</p> <p><strong>Affected:</strong> npm: @sync-in/server</p> <p>**Affected component:** Sync-in Server v2.3.0, `POST /api/app/sync/operation/diff/:id`, vulnerable implementation of `pathFilters` in `backend/src/applications/sync/dtos/sync-operations.dto.ts`.</p> <p>## Summary</p> <p>In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through `pathFilters` and compiled it into a `RegExp` without complexity validation. The resulting regex was then executed synchronously against relative file paths during diff generation.</p> <p>A catastrophic-backtracking pattern, such as `^(a+)+b`, can block the affected Node.js event loop when evaluated against a worst-case path shape. In a single-process deployment, this can make the server unavailable to other users while the regex evaluation is running. Repeated malicious requests can sustain the denial of service.</p> <p>## Details</p> <p>`SyncDiffDto` transformed user input directly into a `RegExp` without validating regex complexity: ```typescript // backend/src/applications/sync/dtos/sync-operations.dto.ts @IsOptional() @Transform(({ value }) =&gt; (typeof value === &#39;string&#39; &amp;&amp; value.length &gt; 0 ? new RegExp(value, &#39;i&#39;) : null)) pathFilters?: RegExp = null ``` The compiled regex was then executed synchronously during sync diff traversal: ```typescript // backend/src/applications/sync/services/sync-manager.service.ts if (ctx.syncDiff.pathFilters &amp;&amp; ctx.syncDiff.pathFilters.test(filePath)) { ``` Because `.test()` is synchronous, a catastrophic-backtracking pattern can block the Node.js event lo…</p> https://db.gcve.eu/vuln/ghsa-jx63-h26r-8cph