Regular Expression Denial-of-Service in npm schema-inspector

Description

What kind of vulnerability is it? Who is impacted? Email address validation is vulnerable to a denial-of-service attack where some input (for example a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.) will freeze the program or web browser page executing the code.

Recommendation

Update the schema-inspector package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-f38p-c2gq-4pmr
• www.npmjs.com
• security.netapp.com
• CVE-2021-21267
• CWE-20
• CWE-400
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• prismjs Regular Expression Denial of Service vulnerability - CVE-2021-3801
• Regular Expression Denial of Service (ReDoS) in Prism - CVE-2021-32723
• Regular expression denial of service in jquery-validation (GHSA-j9m2-h2pv-wvph) - CVE-2021-43306
• Regular Expression Denial of Service in postcss (GHSA-hwj9-h5mp-3pm3) - CVE-2021-23368

Tags:

npm

schema-inspector