Executive brief
@absolunet/kafe is a JavaScript library used for data validation and processing. A flaw in its email validation logic allows an attacker to trigger excessive CPU consumption by submitting crafted invalid email addresses, potentially causing service slowdowns or outages for applications that depend on this library.
Technical details
A regular expression denial of service (ReDoS) vulnerability exists in @absolunet/kafe's email validation function. The vulnerable regex pattern fails to efficiently handle crafted invalid email inputs, causing catastrophic backtracking that consumes excessive CPU resources. An unauthenticated attacker can exploit this via network by sending specially crafted email validation requests to any application using the library, resulting in service degradation or denial of service. The vulnerability affects all versions before 3.2.10, which contains a patched regex pattern that prevents the ReDoS condition.
Affected products
- Absolunet kafe before 3.2.10
Timeline
- 2021-05-10: disclosed
- 2021-05-10: patched: Version 3.2.10 contains fix