Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

npm-user-validate

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    Regular Expression Denial of Service in npm-user-validate

    CVE-2020-7754 · GHSA-pw54-mh39-w3hc

    Affected
    • npm npm-user-validate <= 1.0.0
    Fixed in
    1.0.1· Vendor fix available
    Issue
    npm-user-validate before version 1.0.1 is vulnerable to a Regular Expression Denial of Service (REDos). The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters. Impact The issue affects the email function. If you use this function to process arbitrary user input with no character limit the application may be susceptible to Denial of Service. Patches The issue is patched in version 1.0.1 by improving the regular expression used and also enforcing a 254 character limit. Workarounds Restrict the character length to a reasonable degree before passing a value to .emal(); Also, consider doing a more rigorous sanitizing/validation beforehand.

    Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked Evidence →