Vulnerability · Published Mar 19, 2021 · Assigned by GitHub_M
CVE-2021-21267Regular Expression Denial-of-Service in npm schema-inspector
High 7.5
In plain English
A high-severity uncontrolled resource consumption in schema-inspector from schema-inspector. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation is vulnerable to a denial-of-service attack where some input (for example `a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`) will freeze the program or web browser page executing the code. This affects any current schema-inspector users using any version to validate email addresses. Users who do not do email validation, and instead do other types of validation (like string min or max length, etc), are not affected. Users should upgrade to version 2.0.0, which uses a regex expression that isn't vulnerable to ReDoS.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | schema-inspector | 2.0.0 | GHSA-f38p-c2gq-4pmr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| schema-inspector | schema-inspector | < 2.0.0 |
Weakness: CWE-400, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/schema-inspector/schema-inspector/security/advisories/GHSA-f38p-c2gq-4pmr x_refsource_CONFIRM
- https://gist.github.com/mattwelke/b7f42424680a57b8161794ad1737cd8f x_refsource_MISC
- https://www.npmjs.com/package/schema-inspector x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210528-0006/ x_refsource_CONFIRM