{"vulnerability": "cve-2026-58270", "sightings": [{"uuid": "1684c225-4a89-426a-abd5-de76687c82d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-58270", "type": "published-proof-of-concept", "source": "https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph", "content": "", "creation_timestamp": "2026-09-22T16:35:08.740544Z"}, {"uuid": "dd4011f9-30f1-4898-878c-ec61c13bc7bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58270", "type": "seen", "source": "https://gist.github.com/alon710/b536815814568f1fe4f87321daa1216e", "content": "# CVE-2026-58270: CVE-2026-58270: Regular Expression Denial of Service (ReDoS) in Sync-in Server\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-58270\n\n## Summary\nCVE-2026-58270 identifies a Regular Expression Denial of Service (ReDoS) vulnerability in Sync-in Server prior to version 2.4.0. An authenticated attacker can supply a complex regular expression in the pathFilters parameter of the sync diff endpoint. When evaluated, this causes catastrophic backtracking, blocking the single-threaded Node.js event loop and rendering the entire server unresponsive.\n\n## TL;DR\nAuthenticated users can cause a complete server-wide denial of service in Sync-in Server by supplying a catastrophic backtracking regular expression to the sync diff endpoint, freezing the Node.js event loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333: Inefficient Regular Expression Complexity\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00289 (21.75th percentile)\n- **Impact**: High Availability Impact (Event Loop Block)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Sync-in Server < 2.4.0\n- **Sync-in Server**: < 2.4.0 (Fixed in: `2.4.0`)\n\n## Mitigation\n\n- Upgrade Sync-in Server to version 2.4.0 or above.\n- Enforce validation layers (such as safe-regex2) on all user-supplied regular expressions.\n- Deploy a non-backtracking regular expression engine such as Google's RE2 for dynamic path filtering.\n- Isolate regular expression matching tasks to dedicated Node.js Worker Threads with strict execution timeouts.\n\n**Remediation Steps:**\n1. Identify active installations of Sync-in Server running versions older than 2.4.0.\n2. Rebuild or update deployment containers using the updated Sync-in Server v2.4.0 source code.\n3. Audit custom integration systems to ensure they do not pass unchecked string inputs directly to the RegExp constructor.\n4. Run the provided test suite in 'backend/src/applications/sync/utils/functions.spec.ts' to verify validation paths are working.\n\n## References\n\n- [GitHub Security Advisory GHSA-jx63-h26r-8cph](https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph)\n- [NVD CVE-2026-58270 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-58270)\n- [Sync-in Server Vulnerability Fix Commit](https://github.com/Sync-in/server/commit/b1dcaa1d1c1bb17ab6c31a404cc9cead7efdd979)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-58270) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T19:32:27.010699Z"}]}