CVE-2016-2537: Is My JSON Valid Project Is My JSON Valid

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.

Affected products

• Is My JSON Valid Project Is My JSON Valid: up to and including 2.12.3

Published 2016-02-23. Last modified 2026-06-17.