Executive brief
The email-existence Node.js library contains a regular expression used to validate email addresses that is vulnerable to ReDoS (Regular Expression Denial of Service) attacks. An attacker can send extremely long, specially-crafted email strings that cause the validation regex to consume excessive CPU resources, leading to service hangs or crashes and availability disruption.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) flaw in the email validation regex pattern (/^\S+@\S+$/) used in index.js. The regex exhibits catastrophic backtracking when processing very long input strings, allowing an attacker to cause exponential computational complexity. The attack requires no authentication and is triggered by passing an overly long email string to the validation function. An attacker can exploit this to cause denial of service by exhausting CPU resources. The patch limits email length to 300 characters per RFC specifications, which prevents the pathological regex behavior.
Affected products
- npm email-existence 0.1.6 and earlier
Timeline
- 2022-12-27: disclosed
- 2018-02-22: patched: Patch commit 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56