CVE-2021-36716 - A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js

Back Back to CVE browser

HIGH

A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js

Published Jul 14, 2021

7.5

HIGH

CVSS 3.1

EPSS 0.99%

Description

A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	is-email	0	1.0.1

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption

References (4)

https://github.com/advisories/GHSA-j377-2x76-558h
Advisory
https://github.com/segmentio/is-email/releases
x_refsource_MISCRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-36716
https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-j377-2x76-558h		Advisory
https://github.com/segmentio/is-email/releases		x_refsource_MISCRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-36716
https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716/		x_refsource_CONFIRMVendor Advisory