CVE-2021-3794

vuelidate is vulnerable to Inefficient Regular Expression Complexity

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d	Patch Third Party Advisory
https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7	Exploit Issue Tracking Patch Third Party Advisory
https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d	Patch Third Party Advisory
https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7	Exploit Issue Tracking Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vuelidate_project:vuelidate::::::::
	cpe:2.3:a:vuelidate_project:vuelidate:1.0.0:alpha1::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:1.0.0:alpha2::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha0::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha1::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha10::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha11::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha12::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha13::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha14::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha15::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha16::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha17::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha18::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha19::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha2::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha20::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha21::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha22::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha23::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha24::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha25::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha3::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha5::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha6::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha7::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha8::::node.js::*
	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha9::::node.js::*

History

24 Sep 2025, 20:48

Type	Values Removed	Values Added
CPE	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha4::::node.js::*	cpe:2.3:a:vuelidate_project:vuelidate:1.0.0:alpha1::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:1.0.0:alpha2::::node.js::*

21 Nov 2024, 06:22

Type	Values Removed	Values Added
References	~~() https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d - Patch, Third Party Advisory~~	() https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d - Patch, Third Party Advisory
References	~~() https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7 - Exploit, Issue Tracking, Patch, Third Party Advisory~~	() https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7 - Exploit, Issue Tracking, Patch, Third Party Advisory

29 Jul 2022, 16:50

Type	Values Removed	Values Added
CWE	~~CWE-400~~	NVD-CWE-Other
CPE	cpe:2.3:a:vuelidate_project:vuelidate:-:::::::*	cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha6::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:::::::: cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha21::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha12::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha8::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha16::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha19::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha1::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha17::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha10::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha13::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha14::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha5::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha20::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha7::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha11::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha3::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha0::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha24::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha25::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha22::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha4::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha18::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha9::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha2::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha15::::node.js::* cpe:2.3:a:vuelidate_project:vuelidate:2.0.0:alpha23::::node.js::*

03 May 2022, 16:04

Type	Values Removed	Values Added
CWE	~~CWE-697~~	CWE-400

28 Sep 2021, 00:47

Type	Values Removed	Values Added
CPE		cpe:2.3:a:vuelidate_project:vuelidate:-:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 5.0 v3 : 7.5
References	~~(CONFIRM) https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7 -~~	(CONFIRM) https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7 - Exploit, Issue Tracking, Patch, Third Party Advisory
References	~~(MISC) https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d -~~	(MISC) https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d - Patch, Third Party Advisory
CWE		CWE-697

15 Sep 2021, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-09-15 13:15

Updated : 2025-09-24 20:48

NVD link : CVE-2021-3794

Mitre link : CVE-2021-3794

CVE.ORG link : CVE-2021-3794

JSON object : View

Products Affected

vuelidate_project

vuelidate

CWE

CWE-1333

Inefficient Regular Expression Complexity

NVD-CWE-Other

7.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

JSON object

Attach tags to CVE-2021-3794

7.5^/10

5.0^/10

Attach tags to `CVE-2021-3794`