GitHub Advisoryadvisory · npm

GHSA-j377-2x76-558h Improper Input Validation in is-email

HIGH Published 2021-12-10 Modified 2022-05-04 Official page ↗
Aliases
CVE-2021-36716
Ecosystem
npm
Packages
is-email
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-400
Reviewed
2021-07-15

Affected packages

• npm is-email: < 1.0.1 → fixed in 1.0.1

Description

is-email helps validate an email address. A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.

Related

Alias · CVE (1)

  • CVE-2021-36716 A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References