Executive brief
The is-email library is a popular Node.js component used to validate email addresses in web applications and services. A regular expression denial of service (ReDoS) vulnerability allows attackers to craft malicious email inputs that cause the validation function to consume excessive CPU resources, potentially crashing or severely degrading application performance for all users.
Technical details
The vulnerability is a ReDoS (CWE-400) flaw in the is-email library's email validation logic, stemming from improper input validation (CWE-20). An attacker can provide specially crafted input to the isEmail() function that triggers catastrophic backtracking in the regex engine, causing exponential CPU consumption. The attack vector is network-based with no authentication or user interaction required—any application that exposes the validation function to untrusted input is vulnerable. This results in denial of service through resource exhaustion. The vulnerability affects all versions before 1.0.1, which contains the fix.
Affected products
- Segment is-email before 1.0.1
Timeline
- 2021-07-14: disclosed: NVD published CVE-2021-36716
- 2021-07-13: patched: Fix released in version 1.0.1
- 2021-12-10: advisory: GHSA-j377-2x76-558h published