Regular expression denial of service in @absolunet/kafe

Description

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.

Recommendation

Update the @absolunet/kafe package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.2.10
• Patched version(s): 3.2.10

References

• GHSA-hgpf-97c5-74fc
• snyk.io
• www.npmjs.com
• CVE-2020-7761
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDoS) in lodash - CVE-2020-28500
• Knwl.js Regular Expression Denial of Service vulnerability - CVE-2020-26306
• Regular Expression Denial of Service in papaparse - CVE-2020-36649
• CommonRegexJS Regular Expression Denial of Service vulnerability - CVE-2020-26305

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@absolunet/kafe