Inefficient regular expression complexity in Valibot - CVE-2025-66020
Published: April 28, 2026
Vulnerability identifier: #VU128350
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-66020
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in EMOJI_REGEX used by the emoji action when processing user-controllable input. A remote attacker can submit a specially crafted short string to cause a denial of service.
The issue is caused by catastrophic backtracking due to overlapping character classes in the regex pattern.
Affected software
Valibot
Confluence Data Center
Confluence Data Center
How to mitigate CVE-2025-66020
Install security update from vendor's website.
Valibot - update to 1.2.0
Confluence Data Center - addressed in versions 9.2.19, 10.2.10
Confluence Data Center - addressed in versions 9.2.19, 10.2.10