CVE-2021-21267: Regular Expression Denial-of-Service in npm schema-inspector
Summary
CVE-2021-21267: Regular Expression Denial-of-Service in npm schema-inspector. Affects schema-inspector versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The npm package schema-inspector is a library used for validating data against a defined schema. It provides various validation functions, including email address validation. The library is widely used by developers to ensure data integrity and consistency in their applications.
Vulnerability Detail
The vulnerability in schema-inspector allows for a Regular Expression Denial-of-Service (ReDoS) attack when validating email addresses. An attacker can provide a specially crafted input that triggers a freeze in the program or web browser page executing the code. This can lead to a denial-of-service situation, impacting the availability of the application. The vulnerability affects all current users of schema-inspector who use any version for email address validation. Users who do not perform email validation are not affected.
How To Fix
Latest published version: 2.1.0 as of 23 Oct 2026
npm install schema-inspector@2.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0
This is the first release that contains the fix.
npm install schema-inspector@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If users choose not to upgrade, the only known workaround is to stop using the email validation feature in the library. Instead, users can accept the email address into their system but save it in a 'not yet validated' state until a verification email is sent to confirm its validity. This approach aligns with best practices for email address validation.
Conclusion
The vulnerability in schema-inspector allows for a ReDoS attack when validating email addresses. Users can fix the vulnerability by upgrading to version 2.0.0 or implement a workaround by disabling the email validation feature. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for schema-inspector →
FAQ
Any current users of schema-inspector who use any version for email address validation are impacted by this vulnerability. Users who do not perform email validation are not affected.
The recommended solution is to upgrade to version 2.0.0 of schema-inspector, which includes a fix for the vulnerability.
The only known workaround is to stop using the email validation feature in the library and implement a verification email process to confirm the validity of email addresses.
The vulnerability can lead to a denial-of-service situation, freezing the program or web browser page executing the code. This can impact the availability of the application.
More information about this vulnerability can be found in the GitHub Gist: https://gist.github.com/mattwelke/b7f42424680a57b8161794ad1737cd8f
Related vulnerabilities
Recent vulnerabilities recorded for schema-inspector.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
