GitHub Advisoryadvisory · npm

GHSA-pw54-mh39-w3hc Regular expression denial of service in npm-user-validate

HIGH Published 2021-05-10 Modified 2021-04-20 Official page ↗
Aliases
CVE-2020-7754
Ecosystem
npm
Packages
npm-user-validate
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-04-20

Affected packages

• npm npm-user-validate: < 1.0.1 → fixed in 1.0.1

Description

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

Related

Alias · CVE (1)

  • CVE-2020-7754 This affects the package npm-user-validate before 1.0.1. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References