Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| uptime-kuma(npm) | 1.15.0 | N/A | N/A |
| uptime-kuma(npm) | 2.0.0-beta.0 | 2.0.0-beta.2 | N/A |
CVSS Metrics
