CVE-2026-58270 Details
Description
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.
A denial-of-service vulnerability has been identified in Sync-in Server versions through 2.3.0. The issue arises in the sync diff endpoint, where user-supplied strings are compiled into regular expressions without proper validation of their complexity. This flaw allows catastrophic backtracking patterns to be used, such as '^(a+)+b', which can block the Node.js event loop. As a result, the server becomes unresponsive to all users until the container is restarted.
Users are advised to update to Sync-in Server version 2.4.0 or later, where this vulnerability has been patched. Additionally, implement validation for the 'pathFilters' input to reject empty or non-string values, enforce a maximum regex pattern length, and use a safety checker to ensure the regex does not contain patterns likely to cause catastrophic backtracking.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sync-in Server | <= 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |