GHSA-j377-2x76-558h

Improper Input Validation in is-email

Source: GitHub Advisory Database (reviewed) High CVE-2021-36716

Packages

Ecosystem	Package	Affected	Fixed in
npm	is-email	< 1.0.1	1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

is-email helps validate an email address. A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-36716 advisory
https://github.com/segmentio/is-email package
https://github.com/segmentio/is-email/releases web
https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716 web