Executive brief
jshamcrest is a JavaScript library that provides matchers for validation. It contains a flaw in its email address validator that can be exploited to cause a denial of service by consuming excessive CPU resources. An attacker can send specially crafted input strings to crash or hang applications using this library, disrupting service availability.
Technical details
The jshamcrest library is vulnerable to a regular expression denial of service (ReDoS) attack in the emailAddress validator. The vulnerability exists in the regex pattern used to validate email addresses, which exhibits catastrophic backtracking when presented with certain malformed input strings (e.g., strings with many repeated characters followed by special sequences). No authentication or user interaction is required—any code path that invokes the emailAddress matcher with untrusted input is exploitable. An attacker can construct a short input string (as few as ~116 characters) that causes the validator to block the event loop for 1.6+ seconds, leading to application hangs or crashes. The jshamcrest package has not received any patches; the vendor recommends migrating to an actively maintained alternative.
Affected products
- jshamcrest jshamcrest 0.7.1 and earlier
Timeline
- 2015-10-25: disclosed: Vulnerability identified and maintainers notified
- 2019-02-18: advisory: Published in GitHub Advisory Database