CVE-2020-7754: Regular Expression Denial of Service (ReDoS)
Node.js npm-user-validate module is vulnerable to a denial of service, caused by a flaw when processing long input strings begin with @ characters for user emails. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-7754.
What is the severity of CVE-2020-7754?
The severity of CVE-2020-7754 is high with a CVSS score of 7.5.
Which software packages are affected by CVE-2020-7754?
The npm-user-validate package before version 1.0.1 is affected by CVE-2020-7754.
How can an attacker exploit CVE-2020-7754?
An attacker can exploit CVE-2020-7754 by sending a specially-crafted input string that begins with '@' characters for user emails, causing a denial of service condition.
Is there a fix available for CVE-2020-7754?
Yes, the fix for CVE-2020-7754 is to update the npm-user-validate package to version 1.0.1 or later.