Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWozNzctMng3Ni01NTho

Improper Input Validation in is-email

is-email helps validate an email address. A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.

Permalink: https://github.com/advisories/GHSA-j377-2x76-558h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWozNzctMng3Ni01NTho
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-j377-2x76-558h, CVE-2021-36716
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-36716
• https://github.com/segmentio/is-email/releases
• https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716/
• https://github.com/advisories/GHSA-j377-2x76-558h

Repository: https://github.com/segmentio/is-email
Blast Radius: 18.3

Affected Packages