medium6.5
CVE-2026-58270
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing.
Impact
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @sync-in/server | <= 2.3.0 | 2.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-jx63-h26r-8cph
- https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph
- https://nvd.nist.gov/vuln/detail/CVE-2026-58270
- https://github.com/Sync-in/server/pull/228
- https://github.com/Sync-in/server/commit/b1dcaa1d1c1bb17ab6c31a404cc9cead7efdd979
- https://github.com/Sync-in/server/releases/tag/v2.4.0