Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-21T21:17:06.060Z",
  "pubdate": "2026-09-21T21:17:06.060Z",
  "executiveSummary": "Sync-in Server versions prior to 2.4.0 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack within the sync diff endpoint. The vulnerability arises from the insecure instantiation of user-supplied strings into RegExp objects without adequate complexity validation. An unauthenticated attacker can exploit this by submitting specially crafted input patterns that trigger catastrophic backtracking during the regex matching process. Because Node.js operates on a single-threaded event loop, the excessive computational load required to process these pathological patterns effectively saturates the CPU, blocking the event loop and rendering the entire server unresponsive to all legitimate users. This Denial of Service condition persists until the container is manually restarted, posing a significant risk to service availability and system stability.",
  "technicalDetails": "The vulnerability resides in the sync diff endpoint of the Sync-in Server platform, which fails to sanitize or validate user-provided strings before processing them as Regular Expressions. In JavaScript and Node.js environments, the RegExp constructor allows for the dynamic creation of patterns. If an application directly passes untrusted input into this constructor, it becomes susceptible to ReDoS attacks if the input contains a regex pattern prone to exponential or polynomial backtracking.\nCatastrophic backtracking occurs when a regex engine attempts to find a match for a complex pattern that allows multiple paths for a single input string. Patterns containing nested quantifiers, such as '^(a+)+b', create a search space that grows exponentially as the length of the input increases. When the engine encounters a mismatch (e.g., a string of 'a's that does not end in 'b'), it attempts every possible permutation of the nested quantifiers before finally returning a failure. Because this evaluation is synchronous and computationally expensive, it monopolizes the Node.js event loop thread.\nThe attack flow proceeds as follows: An attacker identifies the sync diff endpoint and crafts an input payload containing a known catastrophic backtracking pattern. Upon transmission of the request, the Sync-in Server backend receives the malicious string and initializes a new RegExp object using the tainted data. When the engine executes the .test() or .match() method on the provided string, the recursive nature of the backtracking forces the CPU to perform an intractable number of operations. As the Node.js event loop becomes blocked, the process stops handling subsequent I/O events, including authentication requests, API calls, and administrative heartbeats. This results in an application-wide hang. The impact is a total denial of service for all users of the platform, as the server cannot process any further requests until the underlying process or container is terminated and restarted, potentially leading to data loss or operational downtime in collaborative environments."
}