Quick answers
- Is CVE-2021-23388 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-23388 being exploited in the wild.
- How severe is CVE-2021-23388?
- Low severity, with a CVSS score of 3.1, published 7 June 2021.
- Which products and versions are affected?
- forms (npm) SEMVER:introduced=0,fixed=1.3.2.
- Is there a fix for CVE-2021-23388?
- Yes. forms (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-23388 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2021-23388?
- Check whether you run forms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- forms (npm): upgrade to 1.3.2 or later
npm install forms@1.3.2
Technical details
The forms package before version 1.3.2 contains a Regular Expression Denial of Service (ReDoS) vulnerability in the email validation logic (CWE-400). The vulnerable regex pattern used for email validation is susceptible to catastrophic backtracking when processing specially crafted input strings. The attack requires only network access to an application using the vulnerable forms package and no authentication. An attacker can send a malformed email input that causes the regex engine to hang, consuming CPU resources and degrading or disabling the application. The vulnerability was fixed in version 1.3.2 by replacing the problematic regex with a more robust email validator.
Affected products
- npm forms before 1.3.2
Identifiers
- CVE-2021-23388
- GHSA-c56f-grv3-gpfr
Timeline
- 2021-06-07: disclosed: Advisory published
- 2021-06-08: patched: Fix released in version 1.3.2