CVE-2026-92114: a2ui-project a2ui DOS Vulnerability

CVE-2026-92114 Overview

CVE-2026-92114 is a Regular Expression Denial of Service (ReDoS) vulnerability in the a2ui-project a2ui library through version 0.10.6. The flaw resides in the safe_regex.ts file under renderers/web_core/src/v0_9/basic_catalog/functions/ within the Basic Catalog component. Attackers can trigger inefficient regular expression complexity [CWE-400] by supplying crafted input to the affected function. The issue is exploitable over the network without authentication or user interaction. Successful exploitation causes excessive CPU consumption, degrading availability of applications that embed the library.

Critical Impact
Remote, unauthenticated attackers can cause denial-of-service conditions in a2ui-based applications by triggering catastrophic regex backtracking in the Basic Catalog renderer.

Affected Products

a2ui-project a2ui versions up to and including 0.10.6
Component: Basic Catalog (renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts)
Applications embedding the a2ui web_core renderer

Discovery Timeline

2026-09-15 - CVE-2026-92114 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92114

Vulnerability Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) issue classified under [CWE-400] (Uncontrolled Resource Consumption). The affected safe_regex.ts module in the Basic Catalog component contains a regular expression pattern that exhibits catastrophic backtracking when processing specially crafted input strings. When the regex engine attempts to match input containing repeated or ambiguous character sequences, the number of matching paths grows super-linearly with input length. This causes the single-threaded JavaScript event loop to stall while the engine explores backtracking paths. In server-side deployments using Node.js, one crafted request can block the runtime and prevent processing of legitimate traffic.

Root Cause

The root cause is an inefficient regular expression within the safe_regex.ts helper function. Despite the file's protective naming, the pattern permits nested quantifiers or overlapping alternations that trigger exponential backtracking under adversarial input. The library does not enforce input length limits or execution timeouts before invoking the regex.

Attack Vector

Attackers deliver crafted strings through any application input path that reaches the vulnerable Basic Catalog function. No authentication or user interaction is required, and the attack is remotely exploitable. Repeated requests amplify CPU exhaustion, reducing throughput to zero for concurrent users. See the GitHub Issue #2292 and VulDB CVE-2026-92114 advisory for further technical context.

// No verified proof-of-concept code is published for this CVE.
// Refer to the upstream issue and pull request for technical details.

Detection Methods for CVE-2026-92114

Indicators of Compromise

Sustained CPU saturation on Node.js processes hosting a2ui web_core renderers
HTTP request latency spikes correlated with requests containing unusually long or repetitive string parameters
Event loop lag metrics rising sharply during otherwise low-traffic periods

Detection Strategies

Inventory application dependencies to identify use of a2ui at or below version 0.10.6
Instrument the runtime to log requests that trigger regex execution exceeding a defined time budget
Correlate application performance monitoring (APM) data with reverse proxy access logs to isolate offending source addresses

Monitoring Recommendations

Track process-level CPU utilization and Node.js event loop lag for services embedding a2ui
Alert on repeated 5xx responses or request timeouts originating from the Basic Catalog rendering path
Rate-limit and log oversized query parameters and JSON payload strings at the edge

How to Mitigate CVE-2026-92114

Immediate Actions Required

Upgrade a2ui to a fixed release that incorporates GitHub Pull Request #2366 once available
Enforce input length caps on any strings passed to Basic Catalog rendering functions
Deploy a Web Application Firewall (WAF) rule to reject anomalously long or repetitive request parameters

Patch Information

The upstream fix is tracked in GitHub Pull Request #2366 against the a2ui-project a2ui repository. Consumers should pin to a released version that includes the corrected regular expression in safe_regex.ts and rebuild dependent applications.

Workarounds

Wrap calls to the vulnerable function with an execution timeout using worker threads or AbortController
Pre-validate input length and character composition before it reaches the regex
Substitute the vulnerable helper with a linear-time parser or a hardened regex library that enforces backtracking limits

bash

# Example: cap request body size at the reverse proxy to reduce ReDoS surface
# nginx.conf
client_max_body_size 16k;
large_client_header_buffers 4 8k;