Executive brief
The forms package is a Node.js library used to handle form validation and processing in web applications. A flaw in its email validation regex allows attackers to craft malicious input that causes the regex engine to consume excessive CPU resources, potentially denying service to legitimate users. This can impact web application availability.
Technical details
The forms package before version 1.3.2 contains a Regular Expression Denial of Service (ReDoS) vulnerability in the email validation logic (CWE-400). The vulnerable regex pattern used for email validation is susceptible to catastrophic backtracking when processing specially crafted input strings. The attack requires only network access to an application using the vulnerable forms package and no authentication. An attacker can send a malformed email input that causes the regex engine to hang, consuming CPU resources and degrading or disabling the application. The vulnerability was fixed in version 1.3.2 by replacing the problematic regex with a more robust email validator.
Affected products
- npm forms before 1.3.2
Timeline
- 2021-06-07: disclosed: Advisory published
- 2021-06-08: patched: Fix released in version 1.3.2