Skip to content

fix: mitigate ReDoS in regex validation (CVE-2025-5891)#6087

Open
mohitxroxx wants to merge 1 commit intoUnitech:developmentfrom
mohitxroxx:master
Open

fix: mitigate ReDoS in regex validation (CVE-2025-5891)#6087
mohitxroxx wants to merge 1 commit intoUnitech:developmentfrom
mohitxroxx:master

Conversation

@mohitxroxx
Copy link

Q A
Bug fix? yes
New feature? no
BC breaks? no
Deprecations? no
Tests pass? yes
Fixed tickets #6086
License MIT
Doc PR https://github.com/pm2-hive/pm2-hive.github.io/pulls

Summary of changes:

Prevent potential Regular Expression Denial of Service (ReDoS) in Config._valid() by:

  • Adding a maximum input length guard before regex execution
  • Caching compiled RegExp instances
  • Wrapping RegExp construction in try/catch

@CLAassistant
Copy link

CLAassistant commented Mar 4, 2026

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants