CVE-2020-7754: Regular Expression Denial of Service (ReDoS)
Node.js npm-user-validate module is vulnerable to a denial of service, caused by a flaw when processing long input strings begin with @ characters for user emails. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Other sources
This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-7754.
What is the severity of CVE-2020-7754?
The severity of CVE-2020-7754 is high with a CVSS score of 7.5.
Which software packages are affected by CVE-2020-7754?
The npm-user-validate package before version 1.0.1 is affected by CVE-2020-7754.
How can an attacker exploit CVE-2020-7754?
An attacker can exploit CVE-2020-7754 by sending a specially-crafted input string that begins with '@' characters for user emails, causing a denial of service condition.
Is there a fix available for CVE-2020-7754?
Yes, the fix for CVE-2020-7754 is to update the npm-user-validate package to version 1.0.1 or later.