CVE-2020-7761: Regular expression denial of service in @absolunet/kafe
Summary
CVE-2020-7761: Regular expression denial of service in @absolunet/kafe. Affects @absolunet/kafe versions < 3.2.10. Fixed in 3.2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @absolunet/kafe package is an npm package that provides various utilities and functions for web development. It is commonly used to handle email validation. However, versions before 3.2.10 are vulnerable to a regular expression denial of service (ReDoS) attack when validating crafted invalid emails.
Vulnerability Detail
The vulnerability in @absolunet/kafe allows an attacker to cause a denial of service by providing specially crafted invalid emails for validation. This can lead to the application becoming unresponsive or crashing due to the excessive computational resources consumed by the regular expression matching algorithm. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 3.2.10 as of 23 Oct 2026
npm install @absolunet/kafe@3.2.10The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The @absolunet/kafe package before version 3.2.10 is vulnerable to a regular expression denial of service attack. It is recommended to upgrade to the fixed version to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @absolunet/kafe →
FAQ
The vulnerability can cause a denial of service, leading to application unresponsiveness or crashes.
No, upgrading to the fixed version is the recommended solution.
No, only versions before 3.2.10 are vulnerable to this issue.
There is no known exploit publicly available at the moment.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-hgpf-97c5-74fc/GHSA-hgpf-97c5-74fc.json
