Executive brief
schema-inspector is a JavaScript library used to validate data structures and formats, including email addresses. A flaw in its email validation regular expression allows attackers to craft specially-formatted input that causes the program or browser to freeze or hang, disrupting service for users relying on the library's validation features.
Technical details
The vulnerability is a Regular Expression Denial-of-Service (ReDoS) flaw in the email validation regex pattern used by schema-inspector. The vulnerable regex is susceptible to catastrophic backtracking when processing specially crafted email addresses (e.g., "a@0.0.0.0.0.0..." with many repeated segments). This causes the regex engine to enter exponential time complexity, freezing the application or browser. The vulnerability affects all versions prior to 2.0.0 when the email validation feature is active. Network-reachable applications using this library to validate untrusted email input are vulnerable without authentication. Version 2.0.0 and later use a redesigned, ReDoS-resistant regex pattern with more limited validation scope.
Affected products
- schema-inspector schema-inspector all versions before 2.0.0
Timeline
- 2021-03-14: disclosed
- 2021-03-19: patched: Version 2.0.0 released with ReDoS-resistant regex