CVE-2021-36716: Improper Input Validation in is-email
Summary
CVE-2021-36716: Improper Input Validation in is-email. Affects is-email versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The is-email package is an npm package used for validating email addresses. It provides a function called isEmail(input) that checks if the provided input is a valid email address. This package is vulnerable to a regular expression denial of service (ReDoS) flaw. An attacker can exploit this vulnerability by providing crafted input to the isEmail() function, causing the application to consume excessive CPU resources. This vulnerability affects versions before 1.0.1 of the is-email package for Node.js.
Vulnerability Detail
The vulnerability in the is-email package arises from improper input validation. When the isEmail() function receives crafted input, it triggers a regular expression that can be exploited for a denial of service attack. This can lead to the application becoming unresponsive or consuming excessive CPU resources, impacting the overall performance and availability of the system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
npm install is-email@1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the is-email package is not immediately feasible, a temporary workaround can be implemented by implementing additional input validation measures in the application code. This can include limiting the length of the input or using a different email validation library that is not vulnerable to ReDoS attacks. Here is an example of how to implement input length validation in JavaScript:
const isEmail = require('is-email');
function validateEmail(input) {
if (input.length > 255) {
throw new Error('Invalid email address');
}
return isEmail(input);
}
Conclusion
In conclusion, the is-email package for Node.js is vulnerable to a ReDoS flaw that can be exploited to cause a denial of service attack. It is crucial to update the package to version 1.0.1 or later to mitigate this vulnerability. If immediate updating is not possible, implementing additional input validation measures can serve as a temporary workaround. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for is-email →
FAQ
This vulnerability can be exploited by an attacker to cause a denial of service (DoS) attack on the affected application. It can lead to excessive CPU consumption, making the application unresponsive or slowing down its performance.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the playground will analyze it for any known vulnerabilities, including this one.
Yes, a fix is available for this vulnerability. Updating the is-email package to version 1.0.1 or later will address the issue and prevent the exploitation of the ReDoS flaw.
If updating the is-email package is not immediately feasible, you can implement additional input validation measures in your application code. This can include limiting the length of the input or using a different email validation library that is not vulnerable to ReDoS attacks.
You can find more information about this vulnerability in the GitHub Security Advisory Database. The advisory for this vulnerability can be accessed at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-j377-2x76-558h/GHSA-j377-2x76-558h.json
