Skip to content
OpenAdvisories
Medium · 6.0 CVE-2025-26042 EUVD-2025-6495GHSA-3rw8-4xrq-3f7pGHSA-hx7h-9vf7-5xhg

Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Published Mar 17, 2025 · Updated Jan 26, 2026 · Assigned by mitre

Package: uptime-kuma Ecosystem: npm

Description

Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.

Affected packages

EcosystemPackageAffectedFixedRecord
npm uptime-kuma >= 1.15.0, <= 1.23.16 — GHSA-hx7h-9vf7-5xhg
npm uptime-kuma >= 2.0.0-beta.0, < 2.0.0-beta.2 2.0.0-beta.2 GHSA-hx7h-9vf7-5xhg

References