CVE-2021-23388: Regular expression denial of service in forms
Summary
CVE-2021-23388: Regular expression denial of service in forms. Affects forms versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The forms package is an npm package that provides functionality for handling forms in JavaScript applications. It allows developers to validate form inputs, including email validation. The package versions before 1.3.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when validating email addresses.
Vulnerability Detail
The vulnerability in the forms package arises from a regular expression used for email validation. An attacker can exploit this vulnerability by providing a specially crafted email address that triggers a ReDoS attack. This can lead to a denial of service condition, where the application becomes unresponsive or consumes excessive resources. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
npm install forms@1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the forms package.
Conclusion
The forms package versions before 1.3.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when validating email addresses. To mitigate this vulnerability, it is crucial to update to forms version 1.3.2 or later. For additional support and guidance, please reach out to DevNack.com.
See every vulnerability recorded for forms →
FAQ
This vulnerability can lead to a denial of service condition in applications that use the forms package for email validation. An attacker can exploit the vulnerability by providing a malicious email address, causing the application to become unresponsive or consume excessive resources.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the fix for this vulnerability is to update the forms package to version 1.3.2 or later. This version includes a patch for the ReDoS vulnerability in the email validation regular expression.
No, there are no known workarounds for this vulnerability. It is recommended to update to the fixed version of the forms package.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for forms.
