Executive brief
node-email-check is a Node.js library that validates email addresses. A maliciously crafted email string can cause the validation function to hang indefinitely, making an application using this library unresponsive and enabling a denial-of-service attack against any service that relies on it for email validation.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw affecting the email validation regex pattern used in the scpSyntax component (line 10 of the code). The regex pattern is inefficient due to excessive backtracking when processing crafted input strings that partially match the pattern. An attacker can provide a malformed email address (e.g., containing IPv6 address markers followed by repeated quote characters) that causes the regex engine to spend exponential time attempting to match, resulting in CPU exhaustion and service unavailability. The vulnerability affects all versions up to and including 1.0.4, and is triggered when the `isValidSync()` function is called with adversarial input. No patch is currently available from the vendor.
Affected products
- node-email-check node-email-check 0 through 1.0.4
Timeline
- 2023-09-19: disclosed
- 2023-10-25: advisory