Root cause
Resource abuse & availability
fix: prevent ReDoS in HTMLInputElement pattern validation
A Claude-assisted fix for a regular-expression denial of service capped pattern length and rejected one family of nested quantifiers, but other backtracking shapes still reach the regular expression, so the freeze remains possible.
How AI contributed: Flawed AI-written codePublished Jul 2, 2026 in 
asymmetric-effort/nogginlessdomAll 2 findings in this repository
What actually happenedHide details
NogginLessDom compiles a page-assigned input pattern straight into a regular expression whenever a validity flag, checkValidity() or reportValidity() is read, with no bound on how long matching can run. A Claude-assisted fix added a 1,024-character cap and a narrow nested-quantifier check, but overlapping alternations and grouped repetitions still pass the check and backtrack exponentially, so a hostile pattern can still freeze the event loop. No later release closes the sink.
Fix status
No public fix identified
No minimum fix commit has been established for this finding.
Fix status unresolved
Case facts
- GHSA ID
- GHSA-X4HG-HFWF-P9MW
- Published
- Jul 2, 2026
- Severity
- MEDIUM
- Language
- TypeScript
- AI tool
Claude- AI role
- Flawed AI-written code
- Vulnerable release
- v0.0.21
AI-assisted change
AI-assisted changesrc/dom/html-elements.tssource asymmetric-effort/nogginlessdom@25a3cbac66+22−4
@@ -5,6 +5,16 @@ import { Element, Event, Node } from './index.js'; Show 1 hidden lines
+/**+ * Detect nested quantifiers that can cause catastrophic backtracking.+ * Matches patterns like (a+)+, (a*)+, (a+)*, etc.+ */+function hasNestedQuantifiers(pattern: string): boolean {+ return (+ /([+*])\s*[)]\s*[+*{]/.test(pattern) || /([+*])\s*\}\s*[+*{]/.test(pattern)+ );Show 6 hidden lines
+}+ // Helper to collect descendants by tag function collectDescendants(root: Node, tagName: string): Element[] { const results: Element[] = [];@@ -281,12 +291,20 @@ export class HTMLInputElement extends Element { } let patternMismatch = false;+ const MAX_PATTERN_LENGTH = 1024; if (this.pattern !== '' && this.value !== '') {- try {- const re = new RegExp(`^(?:${this.pattern})$`);Show 17 hidden lines
- patternMismatch = !re.test(this.value);- } catch {+ if (+ this.pattern.length > MAX_PATTERN_LENGTH ||+ hasNestedQuantifiers(this.pattern)+ ) { patternMismatch = false;+ } else {+ try {+ const re = new RegExp(`^(?:${this.pattern})$`);+ patternMismatch = !re.test(this.value);+ } catch {+ patternMismatch = false;+ } } } Adds a 1024-character cap and a narrow nested-quantifier check before the pattern is compiled, but other backtracking shapes such as overlapping alternation still reach the regular expression unchanged.