url-regex CVE-2020-7661
Regular Expression Denial of Service in url-regex.
The problem
url-regex <= 5.0.0 (all published versions) is affected by
CVE-2020-7661 (CWE-1333 Inefficient Regular Expression Complexity (ReDoS)). The published package has
no fix available — exactly what npm audit reports. url-regex builds a regular expression for matching/validating URLs. Its host and domain sub-patterns contained nested quantifiers that backtrack catastrophically: a string like `http://` followed by a long run of host characters and one non-matching byte takes time quadratic-or-worse in the input length, so untrusted input can hang the event loop (a ~20 KB string already takes ~600 ms; larger inputs take many seconds).
The fix — drop-in, no code changes
Add an overrides entry so every direct and transitive dependency on
url-regex resolves to the patched fork, then reinstall:
{
"overrides": {
"url-regex": "npm:@keep-lts/url-regex@^5.0.1"
}
}Equivalent for Yarn: use resolutions. The public API is unchanged — nothing else to do.
✓ Live on npm: @keep-lts/url-regex · or install directly: npm i @keep-lts/url-regex
This is rarely the only one
If url-regex turned up in your npm audit, there are very likely other abandoned dependencies in the same tree whose CVEs also have no fix on npm. Send us your npm audit output — or your Snyk / Dependabot list — and we'll tell you, for free, which of those findings we already fix. No call, no obligation.
Mid-audit and need a vendor on the hook? Keep LTS Pro adds an SLA on future CVEs and the SBOM / VEX artefacts your auditor will accept — all async, no calls.
What we changed
The host and domain sub-patterns are rewritten from `(?:[a-z0-9][-_]*)*[a-z0-9]+` to `[a-z0-9]+(?:[-_]+[a-z0-9]+)*` (and the `-`-only domain variant similarly). The two forms accept exactly the same hostnames — verified identical across a corpus of 27 URLs in all four strict/exact option combinations — but the rewrite removes the ambiguous overlap that caused backtracking, so matching is linear. Unlike `url-regex-safe`, which only avoids the ReDoS when the optional native `re2` module is installed (and silently falls back to the vulnerable engine otherwise), this fix is pure JavaScript and always safe.
Proof of concept (the vulnerability)
const urlRegex = require('url-regex');
const re = urlRegex({ exact: true });
re.test('http://' + 'a'.repeat(200000) + '!'); // hangs for many seconds on 5.0.0@keep-lts/url-regex@5.0.1How we keep it trustworthy
- Minimal, surgical patch — security only, no feature changes.
- A regression test that fails on the original and passes on the patch; legitimate behaviour preserved.
- Published under the
@keep-ltsorg with the full advisory and tests inside the package; upstream license & attribution retained.
Full advisory and changelog ship inside the package (SECURITY.md, CHANGELOG.md).