CVE-2020-7754: Regular expression denial of service in npm-user-validate
Summary
CVE-2020-7754: Regular expression denial of service in npm-user-validate. Affects npm-user-validate versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Also tracked for
- npm-user-validate · ghsa
The same CVE-2020-7754 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
npm-user-validate is an npm package used for validating user emails. It provides a regular expression to validate email addresses. The package is widely used in npm ecosystems. However, versions before 1.0.1 are vulnerable to a regular expression denial of service (ReDoS) attack. This vulnerability can be exploited by providing long input strings beginning with '@' characters, causing the regex validation to take exponentially longer to process.
Vulnerability Detail
The vulnerability in npm-user-validate arises from the inefficient regex used to validate user emails. An attacker can craft a malicious input string that triggers a ReDoS attack, causing the validation process to consume excessive CPU resources and potentially leading to a denial of service. The impact of this vulnerability can be severe, as it allows an attacker to disrupt the functionality of applications relying on npm-user-validate.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
npm install npm-user-validate@1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the npm-user-validate package to the fixed version.
Conclusion
The vulnerability in npm-user-validate can be mitigated by updating the package to version 1.0.1 or later. It is crucial for developers to promptly apply this fix to prevent potential denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm-user-validate →
FAQ
npm-user-validate is an npm package used for validating user emails.
The vulnerability allows an attacker to perform a denial of service attack by exploiting the inefficient regex used for email validation in npm-user-validate.
To fix this vulnerability, update the npm-user-validate package to version 1.0.1 or later.
There is no known workaround. It is recommended to update the npm-user-validate package.
You can find more information about this vulnerability in the GitHub Advisory Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for npm-user-validate.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
