DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-58270: CVE-2026-58270: Regular Expression Denial of Service (ReDoS) in Sync-in Server

#security #cve #cybersecurity

CVE-2026-58270: Regular Expression Denial of Service (ReDoS) in Sync-in Server

Vulnerability ID: CVE-2026-58270
CVSS Score: 6.5
Published: 2026-09-22

CVE-2026-58270 identifies a Regular Expression Denial of Service (ReDoS) vulnerability in Sync-in Server prior to version 2.4.0. An authenticated attacker can supply a complex regular expression in the pathFilters parameter of the sync diff endpoint. When evaluated, this causes catastrophic backtracking, blocking the single-threaded Node.js event loop and rendering the entire server unresponsive.

TL;DR

Authenticated users can cause a complete server-wide denial of service in Sync-in Server by supplying a catastrophic backtracking regular expression to the sync diff endpoint, freezing the Node.js event loop.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1333: Inefficient Regular Expression Complexity
  • Attack Vector: Network (AV:N)
  • CVSS Score: 6.5 (Medium)
  • EPSS Score: 0.00289 (21.75th percentile)
  • Impact: High Availability Impact (Event Loop Block)
  • Exploit Status: Proof-of-Concept (PoC) available
  • KEV Status: Not listed

Affected Systems

  • Sync-in Server < 2.4.0
  • Sync-in Server: < 2.4.0 (Fixed in: 2.4.0)

Code Analysis

Commit: b1dcaa1

Enforce length limitations and complexity analysis for path filters using safe-regex2 to prevent Regular Expression Denial of Service (ReDoS).

--- a/backend/src/applications/sync/dtos/sync-operations.dto.ts\n+++ b/backend/src/applications/sync/dtos/sync-operations.dto.ts\n-  @Transform(({ value }) => (typeof value === 'string' && value.length > 0 ? new RegExp(value, 'i') : null))\n+  @Transform(({ value }) => transformPathFilters(value))
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Advisory: Exploit workflow description detailing how to authenticate and deliver backtracking-inducing payloads to the path filter logic.

Mitigation Strategies

  • Upgrade Sync-in Server to version 2.4.0 or above.
  • Enforce validation layers (such as safe-regex2) on all user-supplied regular expressions.
  • Deploy a non-backtracking regular expression engine such as Google's RE2 for dynamic path filtering.
  • Isolate regular expression matching tasks to dedicated Node.js Worker Threads with strict execution timeouts.

Remediation Steps:

  1. Identify active installations of Sync-in Server running versions older than 2.4.0.
  2. Rebuild or update deployment containers using the updated Sync-in Server v2.4.0 source code.
  3. Audit custom integration systems to ensure they do not pass unchecked string inputs directly to the RegExp constructor.
  4. Run the provided test suite in 'backend/src/applications/sync/utils/functions.spec.ts' to verify validation paths are working.

References

Read the full report for CVE-2026-58270 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)