GitHub Advisoryadvisory · npm

GHSA-c56f-grv3-gpfr Regular expression denial of service in forms

MEDIUM Published 2021-06-07 Modified 2021-06-02 Official page ↗

Aliases: CVE-2021-23388
Ecosystem: npm
Packages: forms
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses: CWE-400
Reviewed: 2021-06-02

Affected packages

• npm forms: < 1.3.2 → fixed in 1.3.2

Description

The package forms before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.

Related

Alias · CVE (1)

CVE-2021-23388 The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email… vulnerability

Weakness · CWE (1)

CWE-400 Uncontrolled Resource Consumption weakness

References