CVE-2025-66020: Valibot has a ReDoS vulnerability in `EMOJI_REGEX`

November 26, 2025

The EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can cause the regex engine to consume excessive CPU time (minutes), leading to a Denial of Service (DoS) for the application.

References

github.com/advisories/GHSA-vqpr-j7v3-hqw9
github.com/open-circle/valibot
github.com/open-circle/valibot/commit/cfb799db301a953a0950d5c05a34a3ab121262dc
github.com/open-circle/valibot/security/advisories/GHSA-vqpr-j7v3-hqw9
nvd.nist.gov/vuln/detail/CVE-2025-66020

Code Behaviors & Features

Detect and mitigate CVE-2025-66020 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →