# CVE-2021-23388: forms regular expression denial of service in email validation

Source: https://junglewise.ai/threats/cve-2021-23388-forms-regular-expression-denial-of-service-in-email-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-06-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-23388 · Severity: low · CVSS 3.1 · Published 2021-06-07

The forms package is a Node.js library used to handle form validation and processing in web applications. A flaw in its email validation regex allows attackers to craft malicious input that causes the regex engine to consume excessive CPU resources, potentially denying service to legitimate users. This can impact web application availability.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-23388 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-23388 being exploited in the wild.

**How severe is CVE-2021-23388?** Low severity, with a CVSS score of 3.1, published 7 June 2021.

**Which products and versions are affected?** forms (npm) SEMVER:introduced=0,fixed=1.3.2.

**Is there a fix for CVE-2021-23388?** Yes. forms (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-23388 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-23388?** Check whether you run forms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- forms (npm): upgrade to 1.3.2 or later

  ```sh
  npm install forms@1.3.2
  ```


## Technical details

The forms package before version 1.3.2 contains a Regular Expression Denial of Service (ReDoS) vulnerability in the email validation logic (CWE-400). The vulnerable regex pattern used for email validation is susceptible to catastrophic backtracking when processing specially crafted input strings. The attack requires only network access to an application using the vulnerable forms package and no authentication. An attacker can send a malformed email input that causes the regex engine to hang, consuming CPU resources and degrading or disabling the application. The vulnerability was fixed in version 1.3.2 by replacing the problematic regex with a more robust email validator.

## Affected products

- npm forms before 1.3.2

## Identifiers

- CVE-2021-23388
- GHSA-c56f-grv3-gpfr

## Timeline

- 2021-06-07: disclosed: Advisory published
- 2021-06-08: patched: Fix released in version 1.3.2

## References

- [https://github.com/caolan/forms/pull/214](https://github.com/caolan/forms/pull/214)

## Related threats

- [forms Cross-Site Scripting in HTML generation](https://junglewise.ai/threats/cve-2017-16015-forms-cross-site-scripting-in-html-generation)